2 ms·

We've seen it happen before though: http://www.infoworld.com/article/2929732/open-source-software/sourceforge-commits-reputational-suicide.html http://www.infow

We've seen it happen before though: http://www.infoworld.com/article/2929732/open-source-software/sourceforge-commits-reputational-suicide.html http://www.infoworld.com/article/2929732/open-source-softwar... This problem applies not only to editor plugins but all sorts of things nowadays: npm packages for Node.js devs in particular seem like a great way to get viruses, given how hundreds of dependencies get pulled in, sometimes to save 2 or 3 lines of code. Here is an example in the Node package for Postmark (an email service provider) which had a dependency for literally 4 lines of code: https://github.com/wildbit/postmark.js/pull/14/files https://github.com/wildbit/postmark.js/pull/14/files As developers, we need to be willing to reinvent the wheel when needed, instead of blindly installing dozens of 3rd party packages. And we should vet things we install no matter what.

thisacctforreal 9y ago
to be fair with that specific example, they changed from a purpose-built function, to a shell call including (albeit extremely simple) text parsing. I'd generally prefer not to have the git(1) incantation hanging around in an unrelated function.
- conradk 9y ago
  The dependency "git-rev" uses a shell-call too, so this PR doesn't change much apart from removing the dependency itself. Here's the original code from the "git-rev" package: https://github.com/tblobaum/git-rev/blob/master/index.js https://github.com/tblobaum/git-rev/blob/master/index.js