3 ms·
> you’re trusting random strangers on the Internet to run code on your systems I mean that's pretty much how the world works. Even running Linux is trusting ra
by jonknee 8y ago
> you’re trusting random strangers on the Internet to run code on your systems
I mean that's pretty much how the world works. Even running Linux is trusting random strangers on the internet. Most of the time it works pretty well, but obviously it's not perfect. Even the largest companies in the world get caught with security issues from open source packages (remember Heartbleed?).
- nneonneo 8y agoWhen I visit a random website, it is very hard for that website to compromise my computer or my private data. The only really viable way is a zero-day in my browser, or deception (e.g. phishing, malicious download). When I install an app on my iPhone, it is very very hard for that app to compromise my phone or my private data. In both of these cases, I can download and run almost any code, and be fairly confident that it won't significantly harm me. Why? Because they're extremely locked down and sandboxed with a high degree of isolation. On the other hand, if I install random software on my desktop computer, or random packages off NPM, I don't have such safety any more. The prevalence of app stores and the Web itself speaks to the fact that it _is_ possible to trust random strangers without opening yourself up to a big security risk.
- 83457 8y agoI think what you just described are platforms where you don't have to trust strangers.
- swsieber 8y agoYes, and I think they meant to. Node isn't one of those. Edit: partially because of design decisions around package permissions.
- jonknee 8y agoWhat does that have to do with development? My point was nearly everyone uses libraries that are written by strangers from the internet. It mostly works.