2 ms·
> That combined with the 'download random code from any url and run it immediately', means it's going to be much less secure than the already not-that-secure NP
by jeswin 6y ago
> That combined with the 'download random code from any url and run it immediately', means it's going to be much less secure than the already not-that-secure NPM ecosystem.
What deno does is move package management away from the framework distribution. This is great - one thing I hate about node is that npm is default and you get only as much security as npm gives you. (You can switch the npm repo, but it's still the overwhelming favourite because it's officially bundled.)
Deno can eventually give you:
import lib from 'verified-secure-packages.com'
import lib from 'packages.cloudflare.com'
So you'll be able to pick a snippet repository based on your risk appetite.
- HeavyStorm 6y agoBut if Lib itself imports from "unsecure-location.com" deno will access that location and get that file.
- MrBoomixer 6y agoThe idea of the above example is to show a controlled distribution can be made that would verify all levels of imports if needed, which is very promising.