Eliot Lear
Eliot Lear
See forthcoming Issue 34 on this as well.
Yeah, I blathered there a bit. What I was aiming at was something closer to this... Centralization scales governance. The example I am trying to lay out is the converse:...
I'm not aiming for those recommendations here (tho I did just suggest a handful in the CtA). In this case, what I am trying to call out is the level...
Ok then. Should be closed as a dup?
I agree that this is tricky. On the whole, purl is stitching together different namespaces, and most of the threats are around attacks on those namespaces. For example, if someone...
The security considerations should contain remediations without fluff like “dedicated teams...". The point is that you are **naming** the package, and not telling people to blindly do updates. npm is...
Yes please. The registration template can be found in [RFC7595](https://www.rfc-editor.org/rfc/rfc7595.html#section-7.4) Section 7.4, but do read the rest of the document. Today, anyone could conceivably request "pkg:" for other reasons. If...
Fantastic! I've just added purl support for my apt2sbom cyclonedx generation tool. I'll do the same with spdx when I understand where they want that info. Let me know if...
Hmm. Purl reminds us of treasures, while puri reminds us of tasty Indian cuisine ;-) I'd suggest not fixating on the name...
On (1) you have to render these things slightly differently on different media. There are plenty of real life examples, not least of which is the one I'm typing into...