I read a couple of times that “people” tend to trust registered packages. Where does the difference in trust come from? Is a registered package checked for harmful code? Do I miss a point?

My understanding is that registration confers no special security accreditation to a package. There are more eyes on making sure things aren’t going to break other packages, and that the requisite configuration / dependency-specifying files are in place, but to my knowledge no code review is perform…

The checks for automatically registering a package are fairly basic. It has to be able to automatically be installed and loaded. [image] anon94023334: The trust that people place in registered packages probably stems from the fact that it’s easy to see how many other packages depend on them (vi…

One small bit of trust could be that if a registered package was found to have malicious code, the version would be removed (“yanked”) from the registry, so at least you know packages from the registry aren’t known-malicious (which maybe could be different from some git repo found elsewhere on the i…

No, registered packages are not checked in detail. You may be interested in [image] Pkg: attack vectors Internals & Design Pkg ecosystem: Learning from other's mistakes has gotten a bit long and wandering, as these discussions tend to. I’d like to have a very focused thre…

Published VS unpublished // registered vs unregistered

General Usage

Tamas_Papp February 19, 2020, 7:11am 5

No, registered packages are not checked in detail. You may be interested in

Topic		Replies	Views
Security in Julia Packages Package Management question	2	742	January 12, 2023
Pkg: attack vectors Internals & Design security , package-manager	25	3946	September 17, 2020
How to know which Julia package to trust? General Usage question , package	7	1058	September 15, 2022
How to count how many registered packages of Julia exists? General Usage	7	1593	February 10, 2019
Pkg ecosystem: Learning from other's mistakes Community	53	5531	January 3, 2019

Published VS unpublished // registered vs unregistered

Related topics