4 ms·

Why should we trust a company over the community? And how accurate could be the scanning? What if something is missed or if there are a lot of false positives?

• elliekelly 7y ago
  I do wonder how frequently and thoroughly the community is looking at the packages though. Perhaps I'm in the minority but I really only look when I'm debugging or trying to write a similar function myself to remove a dependency. But as a fairly novice and self-taught developer I'm not sure I'd recognize a security threat even if I was staring right at it.
  • 2sk21 7y ago
    That is exactly my point. Studying code for security exploits is hard and tedious work. If I were developing a Node.js app, I would be glad to pay someone to do that for me.
• tjalfi 7y ago
  You can have a contract with a company and take them to court for breach of service. If you don't like their work, you can switch to a different vendor. This isn't ideal but I prefer it to relying on the kindness of strangers. "Altruism is a fine motive, but if you want results, greed works much better." - Henry Spencer