Uh oh!
There was an error while loading. Please reload this page.
doc: add minutes for meeting 28 January - #140
Conversation
Missed the call due to an epic 🤦♂️, but I can see a related discussion - coincidentally last week I implemented this: https://www.npmjs.com/package/allow-scripts tl;dr:
fwiw, I hope I can deprecate that package soon, as Not sure how much in scope this is for |
ljharb
commented
Jan 29, 2019
@dominykas you'd have to pursue that change in both npm and yarn. |
Yarn already has an RFC PR for that, npm has the thread that was mentioned in the call - this can serve as a userland ref/PoC impl to get the standards rolling (it does solve a need at work for me). I agree security wg doesn't have levers to pull this off, but advocacy and awareness is still useful? And --ignore-scripts as a best practice (at least in CI) is also recommendable? (Are we going borderline offtopic?) |
No description provided.