On: GitHub Package Registry

[eitland]

Same as if they pwn debian, redhat, docker, npm, maven (also used by gradle) or Microsoft Windows update infrastructure then?

Or am I missing something?

[sanbor → eitland]

Yes, but instead of having two pwn 5 now they just have to pwn 1.

[eitland → sanbor]

Still don't get it, if you pwn any of the above it is game over for a 10-30 percent of all computers.

Same with GitHub packages, you'll have the possibility to a large number of projects, but far from all IMO.