Hacker News Reader

You do realize that NPM package versions already are immutable? Dunno since when though.

Deletion is possible within limits but it also is with Docker. All the hashes in the world won't bring back a deleted image.

View on HN

They were made immutable after the issue was already widespread. Which is also why I'd heavily encourage to use hashes to pin container versions, even though people might not see the immediate need to do so.

version numbers are never immutable. they are arbitrary labels that are created by some centralized authority and can be changed by that same authority.

artifacts being removed is much less of a problem as artifacts being spoofed with malicious content.

Reply on news.ycombinator.com