Was waiting for the first person to point out that what you get when you visit a url is not guaranteed to be the exact same on a subsequent visit.

Not seeing how url-based package management is safer when a package host can use a server that sends a special payload to certain requester ips, headers, cookies or referrer.

Until there are firm guarantees around what you get from a url, a trust-able third party is needed, even if just as an option.

Figured this out myself:

    $ curl 'https://deno.land/std/examples/welcome.ts'
    console.log("Welcome to Deno ");

So this is an Accept header trick. If I do this instead:

    $ curl 'https://deno.land/std/examples/welcome.ts' -H 'Accept: text/html'

I get back the full HTML version of the page.