zuck9

It is widely known that node modules are a big security risk because of its deeply nested tree and developers tend to not install new packages just for this.

From a recent HN comment [0]:

> Does anyone know if there has been reliable research towards the security of the entire RN dependency tree? Seeing a stray dep there that has 1 maintainer on npm/GitHub who has been inactive for over a year makes me nervous. Any one of those JavaScript projects could do something nefarious deep under the hood, and this to me seems to expose a huge surface area for attackers.

How are you personally mitigating against the risks or what are the policies/processes at your company?

[0] https://news.ycombinator.com/item?id=23160588

Are there any checklists I can follow for improving my opsec?

Google owns the .google gTLD but they haven't been using it for any of their existing products. So far blog.google is the most used. Why haven't they moved * .google.com to * .google?

Gmail (mail.google.com) to mail.google, docs.google.com to docs.google and so on.

Browser support in 2018 should have caught up to support them.

I'd at least expect them to redirect mail.google to mail.google.com if they plan to keep the existing domains.

Signal et al. require a phone number which makes it a no-go for anonymity. What do people recommend for communicating with end-to-end encryption and preferably ephemeral/self-destructing messages?