# Pkg ecosystem: Learning from other's mistakes

**URL:** <https://discourse.julialang.org/t/pkg-ecosystem-learning-from-others-mistakes/18028>\
**Category:** Community\
**Created:** [November 26, 2018, 7:38pm UTC](https://discourse.julialang.org/t/pkg-ecosystem-learning-from-others-mistakes/18028 "2018-11-26T19:38:22Z")\
**Posts on this page:** 1\
**Showing post:** 43

<div class="post-metadata">

**Author:** ![Tamas\_Papp](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tamas_papp/32/25949_2.png) [@Tamas\_Papp](https://discourse.julialang.org/u/Tamas_Papp)\
**Post date:** [December 2, 2018, 7:40am UTC](https://discourse.julialang.org/t/pkg-ecosystem-learning-from-others-mistakes/18028/43 "2018-12-02T07:40:19Z")

</div>

> [@jpsamaroo](#):
>
> If no one is auditing the packages in a trusted registry, then there’s no good reason to trust the trusted registry.

Trust is not an necessarily absolute concept. A procedure that significantly reduces the probability of adverse events can be useful even if it does not completely eliminate them, especially if the alternatives are much more costly.

It is easy to go overboard with suggested security measures, especially after witnessing breaches. Frankly, I am skeptical that we have the community resources at this point to implement serious auditing for a nontrivial set of packages, but that does not preclude a simpler mechanism from being immediately beneficial.

---

_[View the full topic](https://discourse.julialang.org/t/pkg-ecosystem-learning-from-others-mistakes/18028)._