5 ms·
It's basically the same "exposure" as importing a random npm, but it has the benefit if being explicit when you do it. It's also exactly what the websites you
by mrkurt 6y ago
It's basically the same "exposure" as importing a random npm, but it has the benefit if being explicit when you do it.
It's also exactly what the websites you visit do. ;)
- xg15 6y ago> It's basically the same "exposure" as importing a random npm, but it has the benefit if being explicit when you do it. I'm not sure how this works in detail here, but at least in NPM you got a chance to download packages, inspect them and fix the versions if so desired. Importantly, this gave you control over your transitive dependencies as well. This seems more like the curl | bash school of package management. Edit: This is explained in more detail at https://deno.land/manual/linking_to_external_code https://deno.land/manual/linking_to_external_code and indeed seems a lot more sane. > It's also exactly what the websites you visit do. ;) Well yes, and it causes huge problems there already - see the whole mess we have with trackers and page bloat.
- mrkurt 6y agoThe tldr is Deno also gives you a chance to download + inspect packages, and then lock dependencies. The mechanism for import is different, but the tooling is good.
- thysultan 6y agoThe good thing about this is you can effectively build a register service that serves the same level of trust that npm provides, because at the end of the day that is the only deferential in this scenario as npm can just as well return malicious code.
- pedalpete 6y agoThanks for sharing that link. Seems much more sane, but not without issues. I'm sure this will continue to be iterated upon. Even with all NPMs flaws, I do feel this is a bit of throwing the baby out with the bath water. Time will tell.
- greggman3 6y agoAFAIK there is no option to allow a website to read and write random files anywhere to my hard drive period. At most a website can ask the user select a file or offer one for downloading. In the future maybe it can be given a domain specific folder. That's not true here. If I'm running a web server I'm going to need to give the app permission to read the files being served and access to the database. That something that never happens in the browser.
- eyelidlessness 6y ago> It's basically the same "exposure" as importing a random npm, but it has the benefit if being explicit when you do it. This is definitely false. For all the problems with the NPM registry and the Node dependency situation, an NPM package at a specific version is not just at the whims of whatever happens to be at the other end of a URL at any given moment it's requested. This is a huge vulnerability that the Node/NPM world does not currently have.
- mrkurt 6y agoThat is a fair point. I don't think most people who use npms really pay much attention, though, and you're still just an npm update away from getting something unexpected (because really, who puts explicit versions in package.json?). Deno does have lockfiles: https://deno.land/manual/linking_to_external_code/integrity_checking https://deno.land/manual/linking_to_external_code/integrity_... I prefer imports from URLs. And I loathe npm. I get why people would disagree though.
- megavolcano 6y agoDeno has lock files and caches files locally on first import.
- pedalpete 6y agoyeah, but we regularly clear out our cache and lock files, so this doesn't really solve the issue, unless you're commiting all of your packages
- mrkurt 6y agoWhat! Clearing lock files seems wild. How do you know you're getting the right code when you install dependencies?
- megavolcano 6y agoWhy are you _regularly_ clearing lock files? If you're bypassing lock files you're going to have the exact same issue with npm or yarn or any other package manager that downloads from the internet.