Skip to content

Comment on Dependencies should be fetched directly from VCSparent

Comments

There's no such thing as refusing to unpublish, not if you want to avoid prison time.

Package contains child porn, what now?

I think it's implied to be refusing to unpublish at the request of the author; unpublishing due to outside forces is probably inevitable. If some unsupportable content got introduced in a new version (e.g. xz), at least the historical versions would be kept.

That of course brings in questions of cost, trust, and governance, so there's definitely a trade-off…

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.