4 ms·

I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is t

I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me. In my company we take the stable version of the library we want to use and we self-host it. We basically have added a cache that we manage and control what goes into it instead of just trusting a manager. Especially for server-side deployment this is mandatory for security. Things like let's say ffmpeg etc - we never get from random packages but we host them ourselves.

grzm 9y ago
> "I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me." I share your concern. It's a tradeoff: tools that do this are very convenient, and the people who have thought about it have decided in some cases that convenience outweighs the security or stability aspects. And people can make that determination on a case-by-case basis.
greenyoda 9y ago
Just today, someone posted an article about how malware can be distributed via npm: "Harvesting credit card numbers and passwords from websites" https://news.ycombinator.com/item?id=16084575 https://news.ycombinator.com/item?id=16084575 If you self-host a stable version, you'll have some time to hear about potential problems in a new version before updating it.
dmitriid 9y ago
Setting an internal mirror for a registry is often a hassle quite a few companies cannot afford, as it adds more operational burden/costs.
zbentley 9y ago
This can be a good strategy, it just trades one set of problems for another. Bleeding-edge packages from possibly compromised hosts, or self-hosted old versions with potential bugs, security issues, and hard-to-find documentation. Pick your poison, unless you're Red Hat and can spend the time to backport security/bug fixes and maintain a knowledge base for your old versions.

grzm 9y ago

> "I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me." I share your concern. It's a tradeoff: tools that do this are very convenient, and the people who have thought about it have decided in some cases that convenience outweighs the security or stability aspects. And people can make that determination on a case-by-case basis.

greenyoda 9y ago

Just today, someone posted an article about how malware can be distributed via npm: "Harvesting credit card numbers and passwords from websites" https://news.ycombinator.com/item?id=16084575 https://news.ycombinator.com/item?id=16084575 If you self-host a stable version, you'll have some time to hear about potential problems in a new version before updating it.

dmitriid 9y ago

Setting an internal mirror for a registry is often a hassle quite a few companies cannot afford, as it adds more operational burden/costs.

zbentley 9y ago

This can be a good strategy, it just trades one set of problems for another. Bleeding-edge packages from possibly compromised hosts, or self-hosted old versions with potential bugs, security issues, and hard-to-find documentation. Pick your poison, unless you're Red Hat and can spend the time to backport security/bug fixes and maintain a knowledge base for your old versions.