5 ms·
> Anecdotally, devs I know are very sensitive to ads/privacy, much more so than to paying money. They also tend to be sensitive about arbitrary code execution,
by ohazi 7y ago
> Anecdotally, devs I know are very sensitive to ads/privacy, much more so than to paying money.
They also tend to be sensitive about arbitrary code execution, especially when running in a build system, which may be near things like deployment keys.
The only thing keeping npm from turning into a minefield are norms around what is socially acceptable, so developers tend to get super angry when this norm is challenged.
- feross 7y ago> They also tend to be sensitive about arbitrary code execution Presumably, if you're already downloading and executing code that I wrote, you trust me to use `console.log` correctly?
- ohazi 7y agoIt's not you, it's the norms that you were challenging. Developers don't want other people to realize that the only thing stopping them from running "extra" stuff like this on someone else's build machine is convention. After the leftpad fiasco and the recent purescript installer "malware," people have gotten really sensitive about this sort of thing. Everybody knows that npm is a house of cards, but it's easier to hide the problem than to fix it.
- feross 7y agoIf the only thing this whole saga accomplishes is that npm post-install scripts are replaced with proper pre-built binary support, then I'll say this was all worth it. :)
- freeone3000 7y agoThe post-install scripts are installed from the same source as the actual library - the library itself could contain whatever malicious code an attacker wants. Pre-built binaries don't help here.
- AmericanChopper 7y agoPersonally, if you’re trying to inject advertising scripts into my critical infrastructure, then no, I absolutely don’t trust you. Like many others, I put a lot of effort into trying to sanely manage my dependencies, finding adware in there would be an enormous red flag. You’re probably a good person, and you seem to be trying to do something good. But I know almost nothing about you, and even if I did, the fact that you think build pipelines are a good place for adware instantaneously eliminates any trust I might ever have in your judgement.
- baq 7y agoso i guess you're mailing a check in return for services provided?
- yjftsjthsd-h 7y agoFalse dichotomy; the world is not solely consist of adware and paid software.
- baq 7y agoof course. i'm just pointing out that having a 'critical' infrastructure which components have been obtained for free and then complaining about those components asking for money in one way or another is rude; unless the OP already donates and didn't say so, in which case please accept my sincere apologies.
- pferde 7y agoThat's a deeply flawed line of thinking. Those components were obtained at a price of 0 moneys, which at the time of "obtaining" was agreed upon by both sides. In this situation, yes, asking for money later is very rude, in my opinion.
- feross 7y agoJust to make sure I understand you correctly — you believe that because a maintainer releases an open source artifact at a given point in time, you are entitled to dictate the terms that any future artifacts are released under? You might want to reread the MIT license provided with the software to see which guarantees it actually (doesn’t) provide to you.
- Lazare 7y agoSure, but using it incorrectly - or even unusually - is going to be grounds to revoke that trust, obviously. You must be aware that some non-zero number of developers have moved away from your code precisely because they no longer trust you, right? (Not saying that's right, just that it's a thing at least a few devs will have done.)