The builder's path
For: Yarn users can't block a package update that suddenly arrives without the provenance its earlier versions had.
“The unexamined life is not worth living.”
ὁ δὲ ἀνεξέταστος βίος οὐ βιωτὸς ἀνθρώπῳ
Routes to a solution
Each route is a different kind of journey, with real people and organisations to contact at each step, starting with those in every country.
Step 1
Build in the open
Publish the code and invite contributors from the community.
Let the people a free tool helps fund its maintainer directly.
Raise and spend money in the open for a community project.
Grants for open source that makes the internet better.
Network of civic tech groups in many countries; find the one near the problem.
Step 2
Fund the maintainers
Sponsors, collectives and open source grants.
Let the people a free tool helps fund its maintainer directly.
Raise and spend money in the open for a community project.
Grants for open source that makes the internet better.
Network of civic tech groups in many countries; find the one near the problem.
Step 3
Get it adopted
Civic tech groups and public bodies take it up.
Y Combinator's free course and co-founder matching.
Raise and spend money in the open for a community project.
Network of civic tech groups in many countries; find the one near the problem.
Volunteer data scientists working with social-sector organisations.
Ideas, sources and tools for this problem, from first interviews to funding.
what provenance is and how it is published
where a new trust setting would live
labelled the request ‘help wanted’
Starter prompt
Built from this problem's brief. Paste it into Claude or any AI assistant.
Help me design and build a first working prototype for this problem in Anywhere. Problem: Yarn users can't block a package update that suddenly arrives without the provenance its earlier versions had. Who it hurts: Developers and CI systems that install npm packages with Yarn. The moment it hurts: When a popular package's maintainer account is taken over and a malicious version is published by hand. What people do today: People find out from community reports and registry takedowns, hours later. Why it is still unsolved: Yarn has no setting to compare a new version's trust level with earlier ones, and checking provenance for every package adds work to installs. What solved looks like: A Yarn plugin or patch that, at install time, fails with a clear message when a package that had provenance in earlier versions resolves to a version without it. Tested against a local test registry with a downgrade case and a never-had-provenance case. Where: Anywhere First, list what you would need to learn from the people affected before building, as interview questions. Then propose the simplest version that would help, the screens or messages it needs, and the data it would use. Keep it cheap to run, accessible, and respectful of people's privacy. Flag anything you are unsure about instead of guessing.
Talk to the people who live it before you build.
“In the fields of observation chance favours only the prepared mind.”
Dans les champs de l'observation le hasard ne favorise que les esprits préparés.
Get a working version in front of people fast.
Using AI is not cheating. Every tool carries the work of the people who made it, and using it well is how knowledge has always moved forward. The thinking, the care for the people who live the problem, and the judgement are still yours.
“The Analytical Engine weaves algebraical patterns just as the Jacquard-loom weaves flowers and leaves.”
Open data that fits this problem.
“When you know a thing, to hold that you know it; and when you do not know a thing, to allow that you do not know it: this is knowledge.”
Tools matched to what this problem needs.
“We are like dwarfs sitting on the shoulders of giants; we see more, and things more distant, not by our own sharp sight but because we are lifted up by their greatness.”
Ship it responsibly, and find help and funding.
“Your right is to the work alone, never to its fruits.”
कर्मण्येवाधिकारस्ते मा फलेषु कदाचन
karmaṇy evādhikāras te mā phaleṣu kadācana
Kit written for this problem from its brief; every link was checked. Links go to each provider's own site. Zetema is not paid for any listing.