yeah, I felt that when playing myself, do u think this level is not necessary given previous levels? (it would also help me if u indicated ur level of familiarity w/ the concepts s.t i can calibrate)
1. Only the registry itself can build packages (only source provided)
2. Builds must be reproducable (no network or external files during build / publish)
3. New versions are hidden by default
4. Releases can only be published by an account, using a hardware 2fa token + password (no persistent login, no long lasting token)
5. All commits must be signed (maybe block web commits or add a cooldown of a few days?)
6. builtin scanners (using ai, virustotal, existing services)
7. if a security violation is found the version is instantly removed
8. Atleast 1 - 3 Days delay for releases
9. Hard no on binaries / post install scripts and binary data
10. blockchain like public record to see who published, updated, owns what
Same for typescript, by default you still got `any`, best case (for humans and LLM) is a strict linter that will give you feedback on what is wrong. But then (and I saw this a couple times with non-experienced devs), you or the AI has to know it. Write a strict linter config, use it, and as someone with not that much coding knowledge, you may be unfamiliar and thus not asking.
Also move or die is running on love2d, which is an awesome game.
Also I love that trick that you can just zip your files and binary Comcast them to the love2d binary and it will load it.
reply