4 ms·

It depends on a long list of crappy bloated software If you don't actually want to test the software, and just want to create a production mobile/desktop appli

by dsp1234 11y ago

It depends on a long list of crappy bloated software If you don't actually want to test the software, and just want to create a production mobile/desktop application, then it depends on codova, cordova-icon, cordova-splash, semver and it's own source code. That's not a long list. If you want to test it, then it's probably not a shock that it pulls in testing frameworks for testing javascript UIs. including something from an apparently-non-standard source Here are the listed requirements from above: http://nodejs.org/ http://nodejs.org/ npm install -g cordova npm install -g grunt-cli http://phantomjs.org/ http://phantomjs.org/ npm install -g cordova-icon and npm install cordova-splash Can you point out which of these is 'apparently-non-standard'?

pritambaral 11y ago
> That's not a long list It's not the list of top-level pieces of software, it's the amount of code that could have contact with the plaintext or the encryption keys. > If you don't actually want to test And build! Don't forget the building itself. It's not so much harder to exploit an app even if all you have access to is its build stage. ---- This is security software we are talking about. The more lines of code that touch it, the more risky it is of being vulnerable. Not to mention the sheer astronomical difficulty of auditing it. From what I know of the industry, I wouldn't be surprised if a security auditor plain refused to touch this because of the sheer magnitude. And that's without even mentioning it uses npm.
- Freak_NL 11y ago
  A valid concern for a password manager. This is why I like PasswordStore a lot better for managing passwords and other sensitive information. It is a Bash script that only depends on a very select list of binaries (gpg, git, and tree, if I recall correctly). It is also a script simple enough I can even audit it myself: https://www.passwordstore.org/ https://www.passwordstore.org/ For syncing, either use git, or something like syncthing. It doesn't really matter, because all synced files are encrypted by GnuPG before any syncing tools gets access to it.
  - jxy 11y ago
    Thanks for the link to passwordstore.org. Fantastic piece of software!
- mmanfrin 11y ago
  You can build without grunt. Grunt just makes the flow a lot easier to manage.
  - pritambaral 11y ago
    Grunt is not the problem. It's using the npm ecosystem, the thousands of different codebases that I have little guarantee of constance over, that is the problem. Even using node.js alone (and no npm, no other libraries) would be extremely hard to audit, simply because of the huge code footprint of v8 alone. But at least I can download all the sources one time, audit it, and be certain every future build with the exact same versions would be safe. npm doesn't provide even that much guarantee.

by dsp1234 11y ago

pritambaral 11y ago

> That's not a long list It's not the list of top-level pieces of software, it's the amount of code that could have contact with the plaintext or the encryption keys. > If you don't actually want to test And build! Don't forget the building itself. It's not so much harder to exploit an app even if all you have access to is its build stage. ---- This is security software we are talking about. The more lines of code that touch it, the more risky it is of being vulnerable. Not to mention the sheer astronomical difficulty of auditing it. From what I know of the industry, I wouldn't be surprised if a security auditor plain refused to touch this because of the sheer magnitude. And that's without even mentioning it uses npm.

Freak_NL 11y ago
A valid concern for a password manager. This is why I like PasswordStore a lot better for managing passwords and other sensitive information. It is a Bash script that only depends on a very select list of binaries (gpg, git, and tree, if I recall correctly). It is also a script simple enough I can even audit it myself: https://www.passwordstore.org/ https://www.passwordstore.org/ For syncing, either use git, or something like syncthing. It doesn't really matter, because all synced files are encrypted by GnuPG before any syncing tools gets access to it.
- jxy 11y ago
  Thanks for the link to passwordstore.org. Fantastic piece of software!
mmanfrin 11y ago
You can build without grunt. Grunt just makes the flow a lot easier to manage.
- pritambaral 11y ago
  Grunt is not the problem. It's using the npm ecosystem, the thousands of different codebases that I have little guarantee of constance over, that is the problem. Even using node.js alone (and no npm, no other libraries) would be extremely hard to audit, simply because of the huge code footprint of v8 alone. But at least I can download all the sources one time, audit it, and be certain every future build with the exact same versions would be safe. npm doesn't provide even that much guarantee.