3 ms·
I agree. I use and love NPM and others like it, but when it comes down to it, i check-in my dependencies when my applications get "released". Committing the up
by Klathmon 11y ago
I agree. I use and love NPM and others like it, but when it comes down to it, i check-in my dependencies when my applications get "released".
Committing the updates is only one more step, and in my experience it's not even another step since we already have a rule that new installs or dep updates need their own commit.
- voltagex_ 11y agoIt becomes even more important in an "enterprise" environment. I have machines here which are blocked from executing node.exe (at the time, the binary I had wasn't signed). I have machines here that have to authenticate via SSPI/NTLMv2 to a proxy to get out to the net. And don't even get me started on the SSL MITM we have here. I can't run your startup's app here. I can't run your new build tool here.
- brazzledazzle 11y agoAnd the endless list of risk reducing stuff like this (and not just in IT either) is exactly why big companies are slow. Big corps need figure out how to create small disconnected divisions instead of consolidating common services for cost savings. If one of your tiny divisions gets hacked it doesn't take down the rest unless your all on the same systems burdened by the same laundry list of security and policies.