9 ms·

> People install or explicitly download code they want to run Not really, explicit installation are not the real difference: you ask for one package in some pa

by tomxor 9y ago

> People install or explicitly download code they want to run Not really, explicit installation are not the real difference: you ask for one package in some package manager and you will commonly implicitly get a bunch of other dependencies installed, you will likely never be able to feasibly personally audit all those implicitly installed packages if we are talking about e.g OS repositories... The real differences are: 1. Trust of the authority that maintains a collection of repositories. 2. Execution permissions. i.e The package manager for your OS can install code that can run with root privileges if it wants, but you have trust in the authority that maintains the package lists. With the web there isn't any curation of package lists, but the code is sandboxed.

wang_li 9y ago
The last time that a package I installed proceeded to install code that the vendor didn't know about was never. The last time a web page caused my browser to download and run js that the page owner didn't know about was five minutes ago.
- seangrogg 9y ago
  So every package author understands each of their dependencies and all of their respective sub-dependencies, recursively on down? This is probably the best bit of programming humor I've read all morning.
  - wang_li 9y ago
    >So every package author understands each of their dependencies and all of their respective sub-dependencies, recursively on down? Have they personally audited every dependency? Probably not. Is the list of dependencies known? Yes. Is the list fixed? Yes. On the webpage side: Does the content provider know what will be served by their ad network? No. Does the ad network provided content change? Yes, constantly. Does the content provider even know who ultimately will be putting crap on their web page via the ads? No.
    - tomxor 9y ago
      > Does the ad network provided content change? Yes, constantly. Does the content provider even know who ultimately will be putting crap on their web page via the ads? No. Whoa! hold on a sec.. code inside a browser != Ad network, when people insert ads into programs outside of web browsers you will have the same issue, only potentially worse because you wont know if they properly sand-boxed them.
  - tomxor 9y ago
    :D ... obligatory xkcd https://xkcd.com/797/ https://xkcd.com/797/

by tomxor 9y ago

wang_li 9y ago

The last time that a package I installed proceeded to install code that the vendor didn't know about was never. The last time a web page caused my browser to download and run js that the page owner didn't know about was five minutes ago.

seangrogg 9y ago
So every package author understands each of their dependencies and all of their respective sub-dependencies, recursively on down? This is probably the best bit of programming humor I've read all morning.
- wang_li 9y ago
  >So every package author understands each of their dependencies and all of their respective sub-dependencies, recursively on down? Have they personally audited every dependency? Probably not. Is the list of dependencies known? Yes. Is the list fixed? Yes. On the webpage side: Does the content provider know what will be served by their ad network? No. Does the ad network provided content change? Yes, constantly. Does the content provider even know who ultimately will be putting crap on their web page via the ads? No.
  - tomxor 9y ago
    > Does the ad network provided content change? Yes, constantly. Does the content provider even know who ultimately will be putting crap on their web page via the ads? No. Whoa! hold on a sec.. code inside a browser != Ad network, when people insert ads into programs outside of web browsers you will have the same issue, only potentially worse because you wont know if they properly sand-boxed them.
- tomxor 9y ago
  :D ... obligatory xkcd https://xkcd.com/797/ https://xkcd.com/797/