3 ms·

> But that's the whole problem right there. Such a plug-in architecture with every Tom, Dick & Jane writing modules that are loosely vetted and deployed in the

by heywire 10y ago

> But that's the whole problem right there. Such a plug-in architecture with every Tom, Dick & Jane writing modules that are loosely vetted and deployed in the 100's of thousands is broken by design. Wait, are you talking about npm or Drupal? (only kind of kidding)

devwastaken 10y ago
That actually is a really good point about packages on NPM, or rather the culture of a 'package for everything.'. All it would take is somebody to lose their github account or go rogue, for one popular package that requires their package to also be compromised, and then hundreds to thousands of sites are silently vulnerable. Seriously. A standard ES6 JS project will run you to actual hundreds of packages. Thats a huge attack surface.