3 ms·

I imagine people are downvoting this because it's a joke, but aside from being a pretty good joke, it's actually surfacing a relevant security issue. Is it rea

I imagine people are downvoting this because it's a joke, but aside from being a pretty good joke, it's actually surfacing a relevant security issue. Is it really safe that these gists are "always up to date", meaning they can be updated without you necessarily being informed. Essentially this is a `pad-left` situation all over again - micromodules controlled by other people can be deleted or changed at any time, and some of these micromodules may become very widely distributed and relied upon.

mythz 7y ago
left pad is a transitive dependency issue, running an "Always up-to-date" version is no different to visiting a Website that can be shutdown at anytime, except once you've run a Gist App once, you can run it locally offline indefinitely: https://sharpscript.net/docs/gist-desktop-apps#run-apps-offline https://sharpscript.net/docs/gist-desktop-apps#run-apps-offl... So you have the flexibility of both options [1]: web open App # downloads and runs latest version web run App # runs local offline version [1] https://sharpscript.net/docs/gist-desktop-apps#github-sharp-app-commands https://sharpscript.net/docs/gist-desktop-apps#github-sharp-...
- newacctjhro 7y ago
  The difference is that web apps are on a tight sandbox.
  - mythz 7y ago
    The issue with leftpad was that it was a transitive dependency that was yanked and broke everyone depending on it. Gists don't have any dependencies, their encapsulated within the Gist where all code is easily inspectable and publicly verifiable, maintained by a verified GitHub User and all changes have a public audit trail. Yes the sandbox is the difference between Desktop Apps and Web Apps, which is the point, Desktop Apps can do things Web Apps can't do and when you're running a Desktop App you're trusting the publisher just like you are with every other process running on your System.

mythz 7y ago

left pad is a transitive dependency issue, running an "Always up-to-date" version is no different to visiting a Website that can be shutdown at anytime, except once you've run a Gist App once, you can run it locally offline indefinitely: https://sharpscript.net/docs/gist-desktop-apps#run-apps-offline https://sharpscript.net/docs/gist-desktop-apps#run-apps-offl... So you have the flexibility of both options [1]: web open App # downloads and runs latest version web run App # runs local offline version [1] https://sharpscript.net/docs/gist-desktop-apps#github-sharp-app-commands https://sharpscript.net/docs/gist-desktop-apps#github-sharp-...

newacctjhro 7y ago
The difference is that web apps are on a tight sandbox.
- mythz 7y ago
  The issue with leftpad was that it was a transitive dependency that was yanked and broke everyone depending on it. Gists don't have any dependencies, their encapsulated within the Gist where all code is easily inspectable and publicly verifiable, maintained by a verified GitHub User and all changes have a public audit trail. Yes the sandbox is the difference between Desktop Apps and Web Apps, which is the point, Desktop Apps can do things Web Apps can't do and when you're running a Desktop App you're trusting the publisher just like you are with every other process running on your System.