Registries Considered Harmful
The article argues that centralized package registries (like npm, PyPI, etc.) introduce security risks, single points of failure, and governance problems. It advocates for distributing trust through cryptographic signatures and transparency logs instead of relying on a central authority to vouch for package authenticity.