Post

Very good article, however, for package registries like npm, the protocol is not the problem; it is governance. 1/4

Naming is a governance problem. Npm needs better governance around naming packages. Npm could set a rule that no new package can be declared in the global namespace, and set redirect rules to a scoped namespace for legacy packages, like what Node did for internal packages i.e. fs is now node:fs. 2/4

Npm trust problem is a governance issue. Maintainers and developers should trust that the right packages are in the repository. Maintainers need proper release governance to prevent bad releases (validating release, security scans, and proper sign-offs). 3/4

since this keeps coming up one thing I would REALLY urge people to consider is not to build npm but to build *the* package registry, and have lexicons define what an npm package or a Rust crate or a Java whatever looks like when published

this is definitely the more atmospheric approach + one grounded in lessons learned from history of repeated failures

regesta.dev I think @sxzz.dev is working on sth here.

is this actually on atproto? I can't tell from poking around any of the docs, but yes it does aim to do what I described :)

Great article! I'm pretty sure this thoughts cross the mind of every person looking deeply enough into atproto at some point. I think labelers are the most interesting part here and somewhat solve the revocation issue. You just need to standardize "allowlist" consumption exclusively.

More and more people are having this idea 👀 it'd be worth reading through fair pm, and emdash's plugins RFC too

was talking to @danielroe.dev about this a few days ago 👀