6 ms·

Imagine the impact if NPM got hacked instead of Docker Hub. People would go crazy, run the streets like monkeys and yelling why NPM is untrustworthy must be boy

Imagine the impact if NPM got hacked instead of Docker Hub. People would go crazy, run the streets like monkeys and yelling why NPM is untrustworthy must be boycotted. Last time one user got hacked and they blamed NPM for letting it happened. Everyone went crazy...

ohyeshedid 7y ago
That's because npm has a history of screwing the pooch.
- tannhaeuser 7y ago
  What did they do specifically? Not saying npm is beyond criticism, but we shouldn't just accept vague and unsubstantiated claims here.
  - ohyeshedid 7y ago
    There's a few previous issues, just use the site search here for npm and have a look.
leowoo91 7y ago
NPM already freaks out many people.
- quickthrower2 7y ago
  I secretly love NPM. If your open source project’s first code section is “npm i ...” I’m happy.
manigandham 7y ago
Both situations are bad, and people are upset over Docker Hub. It just happens to be Friday night so it's not getting as much attention. NPM is bad because the Javascript ecosystem is fast-moving with loose builds that have thousands of dependencies that are all bundled and run insider consumer's browsers.
- craftoman 7y ago
  I never complained and whined like a baby every time I install Gnome for example, using Debian's apt package manager where it fetches hundreds of packages worth of 1GB. Do you know how many Linux devs required you to use Lua libraries for example only for a single isolated piece of code just because they were too lazy to write it down in C.
  - tomc1985 7y ago
    Most distributions' package repos aren't a free-for-all, unlike NPM It'd be a legit criticism of ruby gems or CPAN, but linux distros are an entirely different kettle of fish, and most of the mainstream distros take security pretty seriously
    - craftoman 7y ago
      Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.
      - dvdgsng 7y ago
        Wait, designed to work with http only? Link?
        craftoman 7y ago
        That was the main reason why it got pawned few months ago. All main sources are using HTTP, it comes as default. It's your responsibility to make it https. Most of the distros are using HTTP by default except a few that respect privacy and security. https://www.theregister.co.uk/2019/01/22/debian_package_manager_flaws/ https://www.theregister.co.uk/2019/01/22/debian_package_mana... https://whydoesaptnotusehttps.com https://whydoesaptnotusehttps.com
        7y ago

ohyeshedid 7y ago

That's because npm has a history of screwing the pooch.

tannhaeuser 7y ago
What did they do specifically? Not saying npm is beyond criticism, but we shouldn't just accept vague and unsubstantiated claims here.
- ohyeshedid 7y ago
  There's a few previous issues, just use the site search here for npm and have a look.

leowoo91 7y ago

NPM already freaks out many people.

quickthrower2 7y ago
I secretly love NPM. If your open source project’s first code section is “npm i ...” I’m happy.

manigandham 7y ago

Both situations are bad, and people are upset over Docker Hub. It just happens to be Friday night so it's not getting as much attention. NPM is bad because the Javascript ecosystem is fast-moving with loose builds that have thousands of dependencies that are all bundled and run insider consumer's browsers.

craftoman 7y ago
I never complained and whined like a baby every time I install Gnome for example, using Debian's apt package manager where it fetches hundreds of packages worth of 1GB. Do you know how many Linux devs required you to use Lua libraries for example only for a single isolated piece of code just because they were too lazy to write it down in C.
- tomc1985 7y ago
  Most distributions' package repos aren't a free-for-all, unlike NPM It'd be a legit criticism of ruby gems or CPAN, but linux distros are an entirely different kettle of fish, and most of the mainstream distros take security pretty seriously
  - craftoman 7y ago
    Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.
    - dvdgsng 7y ago
      Wait, designed to work with http only? Link?
      - craftoman 7y ago
        That was the main reason why it got pawned few months ago. All main sources are using HTTP, it comes as default. It's your responsibility to make it https. Most of the distros are using HTTP by default except a few that respect privacy and security. https://www.theregister.co.uk/2019/01/22/debian_package_manager_flaws/ https://www.theregister.co.uk/2019/01/22/debian_package_mana... https://whydoesaptnotusehttps.com https://whydoesaptnotusehttps.com
      - 7y ago