4 ms·

The reason is that many people don't know how to write a proper isArray. Forgetting about security momentarily (and I promise we'll come back to it), rewriting

The reason is that many people don't know how to write a proper isArray. Forgetting about security momentarily (and I promise we'll come back to it), rewriting code repeatedly is a path towards bugs and mistakes. Array.isArray didn't even exist until pretty recently, and was non-trivial to understand before then (x => x && Object.prototype.toString.apply(x) === "[object Array]", of course!). There's an entire separate discussion of why JavaScript doesn't build this stuff in to begin with, but now we're in historical land and not practical solution land. Ultimately though, the goal needs to be to build tools where its hard to do something insecure regardless of how we otherwise feel about that programming practice. It can't be that the reason we shouldn't install is-array is because it can lead to catastrophic exploits -- that says something about the ecosystem not the validity of where we choose to draw the line of what merits a library. Node is cursed in part by its success. In a lot of ways its like the early days of the web, it grew faster than we had time to figure stuff out in. That's OK if we learn quickly and adjust accordingly. We don't have to run node program's with access to everything -- but again, we don't have to run any kind of program with access to everything. Go to Homebrew's website (https://brew.sh https://brew.sh). This is a developer tool and what they tell you to do is to blindingly copy a bash line that downloads a file from THE MASTER BRANCH on GitHub and runs it on your system: /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" Get access to this guy's password and you can compromise tons of systems too. As much as I hate the Mac App Store as a distribution mechanism, there's something to the "sandbox first" programming mentality it incidentally forces its apps into. Maybe we should be thinking more along those lines too.

PeCaN 8y ago
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" Ignoring the obvious stupidity here, why does it invoke Ruby only to invoke curl?
- tolmasky 8y ago
  It curls the install script, which is passed to ruby as a string which is run.
  - PeCaN 8y ago
    Ah, duh, you're right. I forgot $() is bash syntax and not the Ruby syntax for running an external command. Thanks, and yikes.
- analogmemory 8y ago
  Because the install script is in ruby?
- acobster 8y ago
  That's not what it's doing. It's downloading Ruby code and then running it. The "$(...)" is evaluated first.
golangnews 8y ago
Importing lots of code from others is a path towards bugs and mistakes. You end up not understanding your dependencies, importing far too much (because you want function x but also get a-z), amd dealing with changes you didn't want or need which mix security fixes with features. Better to minimise dependencies particularly for trivial functions. Not just for security but for ease of development.
- blitmap 8y ago
  I love node - it's a really irresponsible way of programming. The objective is to make as much the concern of someone else as possible. "How do I know what an array is? I'm just writing this app that works with arrays.." :-) In seriousness though, there many ways to write an isArray. Just yesterday I was looking at the different things String::repeat() handles on Mozilla's site. What seems trivial can be defined slightly differently everywhere and I tend to reach into the npm bag if I know it's open to interpretation. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/repeat https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
um_ya 8y ago
Perhaps npm packages should be dockerised to prevent this.
madeofpalk 8y ago
> from THE MASTER BRANCH to be fair, there's nothing particular about the branch called 'master'.
- mcintyre1994 8y ago
  The point is that you just have to engineer your way to commit access on master once. If it at least pointed to a github release or an immutable equivalent, it'd be vetted by the author before millions of people point a ruby eval at it.

PeCaN 8y ago

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" Ignoring the obvious stupidity here, why does it invoke Ruby only to invoke curl?

tolmasky 8y ago
It curls the install script, which is passed to ruby as a string which is run.
- PeCaN 8y ago
  Ah, duh, you're right. I forgot $() is bash syntax and not the Ruby syntax for running an external command. Thanks, and yikes.
analogmemory 8y ago
Because the install script is in ruby?
acobster 8y ago
That's not what it's doing. It's downloading Ruby code and then running it. The "$(...)" is evaluated first.

golangnews 8y ago

Importing lots of code from others is a path towards bugs and mistakes. You end up not understanding your dependencies, importing far too much (because you want function x but also get a-z), amd dealing with changes you didn't want or need which mix security fixes with features. Better to minimise dependencies particularly for trivial functions. Not just for security but for ease of development.

blitmap 8y ago
I love node - it's a really irresponsible way of programming. The objective is to make as much the concern of someone else as possible. "How do I know what an array is? I'm just writing this app that works with arrays.." :-) In seriousness though, there many ways to write an isArray. Just yesterday I was looking at the different things String::repeat() handles on Mozilla's site. What seems trivial can be defined slightly differently everywhere and I tend to reach into the npm bag if I know it's open to interpretation. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/repeat https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

um_ya 8y ago

Perhaps npm packages should be dockerised to prevent this.

madeofpalk 8y ago

> from THE MASTER BRANCH to be fair, there's nothing particular about the branch called 'master'.

mcintyre1994 8y ago
The point is that you just have to engineer your way to commit access on master once. If it at least pointed to a github release or an immutable equivalent, it'd be vetted by the author before millions of people point a ruby eval at it.