Hacker GitHub

← All repos

crev-dev/crev

View on GitHub ↗ ★ 431

Socially scalable Code REView and recommendation system that we desperately need. See http://github.com/crev-dev/cargo-crev for real implemenation.

30 mentions on Hacker News by 16 people: 6 stories, 24 comments · first 2019-11-06 · latest 2025-03-27

Mentions per year 30 mentions · busiest year 2022 (11)
20082026
AllStoriesComments NewestTopOldest
  1. …ecosystems. [0] https://github.com/crev-dev/cargo-crev [1] https://mozilla.github.io/cargo-vet/ [2] https://github.com/crev-dev/crev/
    comment by karlding · 2025-03-27 · in Malware found on NPM infecting local package with reverse shell
  2. …There should be better ways to check these problems. The best I have found so far is Crev https://github.com/crev-dev/crev/ . It's most used implementation is Cargo-crev https://github.com/crev-dev/cargo-crev , but hopefully it will become…
    comment by chaxor · 2024-01-06 · in Hard disk LEDs and noisy machines
  3. Looks like there's an implementation of it for npm: https://github.com/crev-dev/crev I've been willing to try it for a while for Rust projects but never committed to spending the time. Any feedback?
    comment by sgu999 · 2023-03-30 · in 50% of new NPM packages are spam
  4. …package repositories to audit packages or trying to assign trust onto random developers. [1]: https://github.com/crev-dev/crev [2]: https://github.com/vouch-dev/vouch [3]: https://github.com/mozilla/cargo-vet
    comment by remram · 2023-02-24 · in NPM repository flooded with 15,000 phishing packages
  5. …rather than the package authors. This seems like a much more viable solution to scale trust. [1]: https://github.com/crev-dev/crev [2]: https://github.com/vouch-dev/vouch [3]: https://github.com/mozilla/cargo-vet
    comment by remram · 2022-11-02 · in Dozens of malicious PyPI packages discovered targeting developers
  6. …code review[0], it can fix some of the single-points-of-failure that attackers might target. [0] https://github.com/crev-dev/crev
    comment by dane-pgp · 2022-07-29 · in Sigstore the Hard Way
  7. Alternatives to cargo-vet that has been mentioned before here on HN: - https://github.com/crev-dev/crev - https://github.com/vouch-dev/vouch Anyone know of any more alternatives or similar tools already available?
    comment by diggan · 2022-06-13 · in Vetting the Cargo
  8. …for you, but it might be nice to manage those trust relationships in a single UI/config. [0] https://github.com/crev-dev/crev
    comment by dane-pgp · 2022-05-04 · in Sigstore - A new standard for signing, verifying and protecting software
  9. …g/philosophy/who-does-that-server-really-s... [1] https://www.gnu.org/software/librejs/index.html [2] https://github.com/crev-dev/crev
    comment by dane-pgp · 2022-05-04 · in A minimal C compiler in x86 assembly
  10. I plug this every time, but here goes: https://github.com/crev-dev/crev solves this by providing code reviews, scales via a web-of-trust model, and relies on cryptographic identities. That way, you can depend on a package without having to…
    comment by remram · 2022-02-20 · in Compromising Angular via expired NPM publisher email domains
  11. This exists, it's called crev: https://github.com/crev-dev/crev As you note, this doesn't require a blockchain. crev uses a web-of-trust model which is pretty well suited to the task.
    comment by remram · 2022-01-17 · in Faker.js is now a community controlled project
  12. This is the better link IMO: https://github.com/crev-dev/crev
    comment by sulam · 2022-01-11 · in Crev – Socially scalable Code REView and recommendation system
  13. This exists, it's called crev: https://github.com/crev-dev/crev It is really good, allowing for distributed reviews, not necessarily from the people authoring your dependencies. The OP suggests that if you -> A -> B, the package manager…
    comment by remram · 2022-01-11 · in What NPM should do to stop a new colors attack
  14. …similar to the idea of Crev[1] from the Rust ecosystem. [0] https://transparency.dev/#trillian [1] https://github.com/crev-dev/crev
    comment by dane-pgp · 2022-01-03 · in Gossamer: Supply Chain Security for Open-Source Software
  15. …easily fixable by using tooling to help review. For example I have high hopes in the crev project: https://github.com/crev-dev/crev As soon as you are no longer implicitly trusting all future versions of your dependencies, things become…
    comment by remram · 2021-11-15 · in From zero to hero: contributing to open source (2017)
  16. …code review.[2] [0] https://docs.sigstore.dev/ [1] https://github.com/kpcyrd/pacman-bintrans [2] https://github.com/crev-dev/crev
    comment by dane-pgp · 2021-10-29 · in CII' FOSS best practices criteria
  17. …Rust has cargo-crev [1] as an implementation. Here's the previous HN discussion [2]. [0] https://github.com/crev-dev/crev/ [1] https://github.com/crev-dev/cargo-crev [2] https://news.ycombinator.com/item?id=18824923
    comment by karlding · 2020-11-03 · in Malicious NPM package opens backdoors on programmers' computers
  18. Maybe using crev? https://github.com/crev-dev/crev https://github.com/crev-dev/cargo-crev Probably just publish it and eventually you will get some review or bug reports.
    comment by pabs3 · 2020-10-21 · in Ask HN: How to find code reviewers for new FOSS projects?
  19. https://github.com/crev-dev/crev/ People willing to help out with `npm-crev` implementation needed. :)
    comment by dpc_pw · 2020-10-03 · in A web of trust for NPM
  20. You mean like crev? https://github.com/crev-dev/crev/ Basically a web of code reviews. There is a pup integration in the early stages per the README. I came across crev through the cargo/rust integration.
    comment by swsieber · 2020-10-03 · in Python typosquatting is about more than typos
  21. I'm a proponent of distributed code reviews as a solution: https://github.com/crev-dev/crev Ultimately, someone has to manually review the code. Antivirus-like heuristics won't catch everything. Sandboxing may prevent some exfiltration,…
    comment by pornel · 2020-09-04 · in Software supply chain security
  22. This project looks interested as well https://github.com/crev-dev/crev
    comment by JVillella · 2020-09-01 · in Ask HN: How do you keep up with changes to open source deps.
  23. Relevant: "crev" is a system for socially scalable and cryptographically verifiable dependency review https://github.com/crev-dev/crev
    comment by dpc_pw · 2020-07-20 · in Our Software Dependency Problem (2019)
  24. …cargo-crev [1], but I suppose you could extend this to AUR packages with a bit of work. [0] https://github.com/crev-dev/crev/ [1] https://github.com/crev-dev/cargo-crev
    comment by karlding · 2020-04-22 · in Running an independent Arch Linux rebuilder