<story><title>The Update Framework</title><url>https://theupdateframework.github.io/</url></story><parent_chain></parent_chain><comment><author>heavenlyhash</author><text>Everyone: Read this.  At least the threat models.&lt;p&gt;Do not assume all software you currently use gets these things right.</text></comment>
<story><title>The Update Framework</title><url>https://theupdateframework.github.io/</url></story><parent_chain></parent_chain><comment><author>doublerebel</author><text>So obviously we have to wonder why TUF hasn&amp;#x27;t been applied to NodeJS&amp;#x27;s npm.  All I can find is a suggestion that maybe someone from TUF posted to a node mailing list in 2014 [1].  Any more recent info?&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;groups.google.com&amp;#x2F;forum&amp;#x2F;m&amp;#x2F;?fromgroups#!topic&amp;#x2F;theupdateframework&amp;#x2F;GbWtUbnO8_I&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;groups.google.com&amp;#x2F;forum&amp;#x2F;m&amp;#x2F;?fromgroups#!topic&amp;#x2F;theupda...&lt;/a&gt;</text></comment>