5 ms·
It's not just more vulnerable, it's incredibly so.
by eeZah7Ux 7y ago
It's not just more vulnerable, it's incredibly so.
- wesleytodd 7y agoWhich platform do you use which does not rely on large amounts of open source libraries?
- okareaman 7y agoPowershell has a security model. Also, Ryan Dahl (creator of node.js) is working on Deno as a replacement because he thinks he made a mistake with node. 10 Things I Regret About Node.js - Ryan Dahl https://www.youtube.com/watch?v=M3BM9TB-8yA https://www.youtube.com/watch?v=M3BM9TB-8yA
- wesleytodd 7y agoRyan is one person and not involved with node anymore. Deno also has many mistakes IMO, so fine to agree to disagree on this one.
- okareaman 7y agoInteresting. You think he is making mistakes again? He complains about "second system syndrome." I've been using Deno for hobby projects and find a lot to like about it.
- mikewhy 7y agoThere's a bit more to it than that. The article touches on the fact that whats on npm doesn't have to match with what's on github (which is true for any package system that isn't 100% backed by source control).
- benologist 7y agoIt's not more vulnerable, it's as-vulnerable as any other package manager where anyone may upload code without sufficient review for people to blindly install and run. We have already seen this abused in browser extensions being repurposed to inject advertising, in node and ruby modules being converted to malware, cryptocurrency miners being added to games on Steam etc. There was even a Nintendo Switch game that bundled a Ruby IDE, I believe iOS has had apps surreptitiously bundling other software too.