3 ms·
> What protection does NPM actually give you? Dependency version pinning comes to mind. The main difference between this and a random URL is that at least you
by yoz-y 6y ago
> What protection does NPM actually give you?
Dependency version pinning comes to mind. The main difference between this and a random URL is that at least you know that if the module gets bought by a third party, your services or build system won't auto update to some rando's version of the package. IIRC there have been cases when a version was replaced as well.
I think this could be fixed quite easily if one could add a hash and a size after the url, to force a check.
- virgilp 6y agoArguably you can get (even more reliable) version pinning by copying typescript from that random URL & storing it in your own S3 bucket. Sure, you have _some_ work to do, but it's not that much and you 100% control the code from there on.
- yoz-y 6y agoWell, I suppose they do (or will) provide a self hosted version of the registry. Like npm does.
- philholden 6y agoIf you publish your module versions on IPFS that would provide a guarantee to your users the module versions do not change once published. But hashes are not very memorable as module names.
- ignoramous 6y ago> If you publish your module versions on IPFS... Well, using message digests, NPM or Yarn can pretty much guarantee content addressable versions, too. Do not have to use IPFS or blockchains, just because...
- another-dave 6y agoYeah, basically sounds like they could implement it à la Content Security Policy in the browser and it would be well understood right off the bat. Or similar to node_modules, have some way to pull your dependency graph & host locally — At least for enterprise-y adoption I imagine that people will want to have _their_ copy of the code and choose when to update it even if in theory the remote code is locked down.
- mgolawala 6y agoThat is what I figured too. People are rightly concerned about the security implications of this new paradigm of including package dependencies. These concerns and the conversation around them are good and healthy. Give it some time. People will experiment with what works and over time best practices will emerge for the set of trade offs that people are willing to make.
- catears 6y agoI was curious about this so I looked into it. Seems like deno allows for lock files (similar to package-lock.json for NPM) https://deno.land/manual/linking_to_external_code/integrity_checking https://deno.land/manual/linking_to_external_code/integrity_...
- BiteCode_dev 6y agoA single source of trust for the dependancy transport.