3 ms·
npm was a mistake
by zajd 8y ago
npm was a mistake
- always_good 8y agoNPM doesn't change anything here. the same issue would exist if you could only vendor dependencies. Are you sure you understand the issue?
- tzahola 8y agoJavascript was a mistake Edit: Answer to “always_good”: If a toddler shoots himself with a handgun, we can say that his mistake was pulling the trigger. While technically correct, it’s not addressing the real issue, that is, how did the toddler get hold of the gun in the first place?
- always_good 8y agoWrong again. Passing user input into arbitrary shell commands is the mistake. Good examples of amateur criticism that plagues our field, though.
- supermdguy 8y agoHaving the ability to execute arbitrary commands isn't something that's unique to JavaScript.
- scrollaway 8y agoThis isn't a case of JS gun gone wrong. Someone's passing cat inside exec with an arbitrary path instead of using native open&read and path.join. That's a thing possible in almost every modern language. Stop the nonsense. Seriously. Stop.
- mrwilhelm 8y agoProgramming was a mistake.