4 ms·
> I switched to native programming. I mean it has more to do with NPM than Javascript or Node itself, NPM and its "small package that do a single thing" bull p
by throw_m239339 7y ago
> I switched to native programming.
I mean it has more to do with NPM than Javascript or Node itself, NPM and its "small package that do a single thing" bull philosophy, and the fact that multiple versions of the same package are installed in the dependency tree, because NPM allows it, instead of rejecting package conflicts, like Composer or any sane package manager.
Conflicts should be resolved by the developers, upstream, and package managers shouldn't install trees of dependencies, dependencies should be flat.
It has become almost impossible to audit anything with NPM, when you have the same package installed 50 times with 50 different versions locally.
- Latty 7y agoI mean, one could argue that NPM ended up like that because of JS's terrible standard library that includes none of the basics people need all the time. I really like working with TypeScript, but that is the pain point that always comes up.
- timdorr 7y agoThis wasn't an npm vulnerability. It's a direct link to a CDN file that was compromised: https://github.com/iotaledger/trinity-wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38 https://github.com/iotaledger/trinity-wallet/pull/2565/files...