AFAIK there are two official primary repositories for Maven packages (Java language):

• search.maven.org offered by Sonatype Inc.
• mvnrepository.com offered by a private person @frodriguez

Now obviously it makes sense to have a complete archive for backward compatibility purposes. However already as mentioned back 2013 in the interview with Sonatype'S CEO, there are lots of downloads for components with known vulnerabilities. So many seem just to not care.

So is backward compatibility of so much value here? Why not take some action to reduce risks? Of course there is the OWASP dependency check plugin but I think on long term it is possible to implement a deeper risk prevention strategy.

Question: What could be a feasible way to motivate Maven and repository makers to establish some kind of early time warning, like for example reject download of vulnerable components by default? This would in my opinion save a lot of time and electrical power if not to expect every build on the planet to do the check if this can be done centrally effectively.

AFAIK there are two official primary repositories for Maven packages (Java language):

• search.maven.org offered by Sonatype Inc.
• mvnrepository.com offered by a private person @frodriguez

Now obviously it makes sense to have a complete archive for backward compatibility purposes. However already as mentioned back 2013 in the interview with Sonatype's CEO, there are lots of downloads for components with known vulnerabilities. So many seem just to not care.

So is backward compatibility of so much value here? Why not take some action to reduce risks? Of course there is the OWASP dependency check plugin but I think on long term it is possible to implement a deeper risk prevention strategy.

Question: What could be a feasible way to motivate Maven and repository makers to establish some kind of early time warning, like issue special headers on download, or and additionally for example reject download of vulnerable components by default? This would in my opinion save a lot of time and electrical power if not to expect every build on the planet to do the check if this can be done centrally effectively.

UPD. In year 2017, over 80% of projects still seem not to recognize the risks, despite court cases.

AFAIK there are two official primary repositories for Maven packages (Java language):

• search.maven.org offered by Sonatype Inc.
• mvnrepository.com offered by a private person @frodriguez

Now obviously it makes sense to have a complete archive for backward compatibility purposes. However already as mentioned back 2013 in the interview with Sonatype'S CEO, there are lots of downloads for components with known vulnerabilities. So many seem just to not care.

So is backward compatibility of so much value here? Why not take some action to reduce risks? Of course there is the OWASP dependency check plugin but I think on long term it is possible to implement a deeper risk prevention strategy.

Question: What could be a feasible way to motivate Maven and repository makers to establish some kind of early time warning, like for example reject download of vulnerable components by default? This would in my opinion save a lot of time and electrical power if not to expect every build on the planet to do the check if this can be done centrally effectively.

AFAIK there are two official primary repositories for Maven packages (Java language):

• search.maven.org offered by Sonatype Inc.
• mvnrepository.com offered by a private person @frodriguez

Now obviously it makes sense to have a complete archive for backward compatibility purposes. However already as mentioned back 2013 in the interview with Sonatype'S CEO, there are lots of downloads for components with known vulnerabilities. So many seem just to not care.

So is backward compatibility of so much value here? Why not take some action to reduce risks? Of course there is the OWASP dependency check plugin but I think on long term it is possible to implement a deeper risk prevention strategy.

Question: What could be a feasible way to motivate Maven and repository makers to establish some kind of early time warning, like for example reject download of vulnerable components by default? This would in my opinion save a lot of time and electrical power if not to expect every build on the planet to do the check if this can be done centrally effectively.