3 ms·

> I can assume that it's not injecting malicious code into my application. You don't need to assume, npm has an audit command that helps figure out if any of y

> I can assume that it's not injecting malicious code into my application. You don't need to assume, npm has an audit command that helps figure out if any of your package dependencies have reported vulnerabilities: https://docs.npmjs.com/cli/audit https://docs.npmjs.com/cli/audit Does Go?

marcus_holmes 8y ago
useful, I didn't know about this. Thanks. How does the reporting of vulnerabilities work for npm? No, Golang doesn't, but then it doesn't have a registry like npm in the first place. Gophers tend not to use third-party libraries if at all possible.
- thecatspaw 8y ago
  isnt it very common to use github repositories as a library? I seem to recall that this was the way to get libraries, though it has been a few years since I looked into go
  - marcus_holmes 8y ago
    yes, but there's not an actual "registry" as such. Just a bunch of sites that have "useful go library" links.
- justinclift 8y ago
  > Gophers tend not to use third-party libraries if at all possible. That sounds weird to me. It's pretty rare (almost never?) for applications to do useful things without third party libraries. eg any database access, input validation, making sure HTML output isn't malicious, etc. Maybe that's just me though?
  - marcus_holmes 8y ago
    Go has an awesome standard library that does most stuff. There's also a set of "semi-official" libraries for things like crypto that can't be written by amateurs ;) There are some other libraries that are commonly used, but you can count them on one hand. I'm a massive convert to this. Instead of spending my time working out how to get two 3rd-party libraries to talk to each other, I spend my time writing domain-specific code. and my debugging time is spent in repo's that I have a hope of understanding because I wrote them ;) It doesn't suit everyone, and there are frequent rants on golang forums about people not importing dependencies. But every gopher seems to go through the same journey, and end up at a place where they just write their own code rather than importing it.
  - jcr1488 8y ago
    What's even more weird is making every 10 line function a "library" and the average program having 500+ dependencies. JS people are so hung up on "re-usability" that they completely miss the concept of dependency hygiene.
- yawaramin 8y ago
  The process is explained here: https://docs.npmjs.com/reporting-a-vulnerability-in-an-npm-package https://docs.npmjs.com/reporting-a-vulnerability-in-an-npm-p...

marcus_holmes 8y ago

useful, I didn't know about this. Thanks. How does the reporting of vulnerabilities work for npm? No, Golang doesn't, but then it doesn't have a registry like npm in the first place. Gophers tend not to use third-party libraries if at all possible.

thecatspaw 8y ago
isnt it very common to use github repositories as a library? I seem to recall that this was the way to get libraries, though it has been a few years since I looked into go
- marcus_holmes 8y ago
  yes, but there's not an actual "registry" as such. Just a bunch of sites that have "useful go library" links.
justinclift 8y ago
> Gophers tend not to use third-party libraries if at all possible. That sounds weird to me. It's pretty rare (almost never?) for applications to do useful things without third party libraries. eg any database access, input validation, making sure HTML output isn't malicious, etc. Maybe that's just me though?
- marcus_holmes 8y ago
  Go has an awesome standard library that does most stuff. There's also a set of "semi-official" libraries for things like crypto that can't be written by amateurs ;) There are some other libraries that are commonly used, but you can count them on one hand. I'm a massive convert to this. Instead of spending my time working out how to get two 3rd-party libraries to talk to each other, I spend my time writing domain-specific code. and my debugging time is spent in repo's that I have a hope of understanding because I wrote them ;) It doesn't suit everyone, and there are frequent rants on golang forums about people not importing dependencies. But every gopher seems to go through the same journey, and end up at a place where they just write their own code rather than importing it.
- jcr1488 8y ago
  What's even more weird is making every 10 line function a "library" and the average program having 500+ dependencies. JS people are so hung up on "re-usability" that they completely miss the concept of dependency hygiene.
yawaramin 8y ago
The process is explained here: https://docs.npmjs.com/reporting-a-vulnerability-in-an-npm-package https://docs.npmjs.com/reporting-a-vulnerability-in-an-npm-p...