Post

Could npm be rebuilt on atproto? www.jasnell.me/posts/what-i...

jasnell.meWhat If npm Ran on AT Protocol?A thought experiment about what a package registry would look like if built on atproto.

EmNudge

@emnudge.dev

21 June

Great article! I'm pretty sure this thoughts cross the mind of every person looking deeply enough into atproto at some point. I think labelers are the most interesting part here and somewhat solve the revocation issue. You just need to standardize "allowlist" consumption exclusively.

EmNudge

@emnudge.dev

To clarify, you can have a labeler which marks published packages as "safe" with some latency. And another labeler which marks packages as "exploited". You consume both labelers, delaying initial installs until "safe" shows up and upgrading once "exploited" comes up. Detach it from revocation.

21/6/26, 5:58 pm0 reposts2 likes

No replies yet.