4 ms·
Do we need a “days since last NPM-related security disaster” tracker?
by eqmvii 8y ago
Do we need a “days since last NPM-related security disaster” tracker?
- yosito 8y agoSomeone should make this!
- have_faith 8y agoFor what purpose other than feeling smug?
- phendrenad2 8y agoTo shame the community into doing something, maybe.
- have_faith 8y agoWould you shame a child for making a mistake? Shame should be reserved for malice and nefarious action with intent.
- swsieber 8y agoIt's not just shaming for a mistake - it's shaming for repeatedly making mistakes because they're too lazy to implement a mistake-preventing solution.
- iooi 8y agoGot it, so we should treat the npm community as a child, right?
- fatbird 8y agoI would shame an adult who keeps making mistakes that are massively impactful on many others. Given npm's scope within the tech world, there's no way they can be fairly described as a "child". They're a hugely significant entity, and need to act like it.
- solarkraft 8y agoYeah, I would shame a child for a repeated reckless mistake.
- karmakaze 8y agoCan someone instead, make a utility that assuming that my project's packages only get upgraded, not downgraded, could have been compromised or included compromised code? We could then check on each of our projects. If you do downgrade packages then you'd have to run it on prior commits as well.