6 ms·

A smartphone is significantly more secure than a computer. I install lord knows what NPM package from God knows where on a weekly basis. Only since very recentl

A smartphone is significantly more secure than a computer. I install lord knows what NPM package from God knows where on a weekly basis. Only since very recently does mic or camera access cause any kind of system prompt on Mac. Smartphones , for all their faults , at least are far less vulnerable to viruses than pcs. Or at least iOS vs Mac.

admax88q 7y ago
Your device is as secure as you make it. Why are you installing "lord knows what npm package" on your laptop?
- layoutIfNeeded 7y ago
  >Why are you installing "lord knows what npm package" on your laptop? Probably because he installs lord knows what npm packages to his production servers too.
  - admax88q 7y ago
    I don't get why people who even admit that they dont trust these random npm packages can think its okay to ship them in production and put all their user's data at risk. It's malpractice.
    - nothrabannosir 7y ago
      I’d love to know a metric of trust and its relation to customer data. How many trust points for how much PII? I’m assuming it’s a logarithmic scale? And a Debian stable package gets , what, double the points of an npm package? Or I guess it depends on the weekly downloads? What about pip, gems, vim plugins, emacs packages (I’m looking at you melpa) , quicklisp, ... Then we can play an honest thought experiment: how many people satisfy that metric? Don’t forget to correct for actually how much PII points one is handling. If you don’t at least have some consideration of those factors, claiming malpractice seems fatuous.
      - admax88q 7y ago
        It's not a question of establishing an absolute scale of trust. It's about admitting that you consider npm packages to be insecure, but you run them in production anyways. Imagine you believed that steel had a 10% chance of spontaneous combustion, regardless of whether its true or not, if you believe that and you still built a bridge out of it, that's malpractice.
        nothrabannosir 7y ago
        Point being where is the line? How high are the stakes (bridge: say 20 human lives at any time, very important). How dangerous is it really? (10% chance of fire per year: extremely high). Then you combine those two and see if they match. Everything has a limit. Otherwise why do you trust your compiler, your computer, your eyes, your sanity? Be careful with a word like malpractice, and analogies that suggest blithe endangerment of human lives. It doesn’t leave a lot of room for honest engagement and suggests you either don’t understand the human mind, or the value of a human life.
        admax88q 7y ago
        You continue to miss the point. Its not a question of _why_ I trust my compiler or my computer. If you trust npm packages and ship them then that's not malpractice. Its about admitting you _don't_ trust npm packages, but you go ahead and use them anyways. That is malpractice, because you admit you know better but take action anyways. "I know this procedure may do more harm than good, but I will perform it anyways because I'm too lazy to find an alternative" That is textbook malpractice.
        nothrabannosir 7y ago
        Trust? I don’t even trust my eyes.. :) Though yes, if laziness is what makes it malpractice, then I’m the Jack Kevorkian of IT. I plead guilty.
        7y ago
meruru 7y ago
I consider my desktop computer to be far more secure than my phone, since it's harder for someone to access it physically and it isn't running Android. The things I install on it are more trustworthy as well, since they're mostly small, established unix tools.

admax88q 7y ago

Your device is as secure as you make it. Why are you installing "lord knows what npm package" on your laptop?

layoutIfNeeded 7y ago
>Why are you installing "lord knows what npm package" on your laptop? Probably because he installs lord knows what npm packages to his production servers too.
- admax88q 7y ago
  I don't get why people who even admit that they dont trust these random npm packages can think its okay to ship them in production and put all their user's data at risk. It's malpractice.
  - nothrabannosir 7y ago
    I’d love to know a metric of trust and its relation to customer data. How many trust points for how much PII? I’m assuming it’s a logarithmic scale? And a Debian stable package gets , what, double the points of an npm package? Or I guess it depends on the weekly downloads? What about pip, gems, vim plugins, emacs packages (I’m looking at you melpa) , quicklisp, ... Then we can play an honest thought experiment: how many people satisfy that metric? Don’t forget to correct for actually how much PII points one is handling. If you don’t at least have some consideration of those factors, claiming malpractice seems fatuous.
    - admax88q 7y ago
      It's not a question of establishing an absolute scale of trust. It's about admitting that you consider npm packages to be insecure, but you run them in production anyways. Imagine you believed that steel had a 10% chance of spontaneous combustion, regardless of whether its true or not, if you believe that and you still built a bridge out of it, that's malpractice.
      - nothrabannosir 7y ago
        Point being where is the line? How high are the stakes (bridge: say 20 human lives at any time, very important). How dangerous is it really? (10% chance of fire per year: extremely high). Then you combine those two and see if they match. Everything has a limit. Otherwise why do you trust your compiler, your computer, your eyes, your sanity? Be careful with a word like malpractice, and analogies that suggest blithe endangerment of human lives. It doesn’t leave a lot of room for honest engagement and suggests you either don’t understand the human mind, or the value of a human life.
        admax88q 7y ago
        You continue to miss the point. Its not a question of _why_ I trust my compiler or my computer. If you trust npm packages and ship them then that's not malpractice. Its about admitting you _don't_ trust npm packages, but you go ahead and use them anyways. That is malpractice, because you admit you know better but take action anyways. "I know this procedure may do more harm than good, but I will perform it anyways because I'm too lazy to find an alternative" That is textbook malpractice.
        nothrabannosir 7y ago
        Trust? I don’t even trust my eyes.. :) Though yes, if laziness is what makes it malpractice, then I’m the Jack Kevorkian of IT. I plead guilty.
        7y ago

meruru 7y ago

I consider my desktop computer to be far more secure than my phone, since it's harder for someone to access it physically and it isn't running Android. The things I install on it are more trustworthy as well, since they're mostly small, established unix tools.