4 ms·

My concern is what happens when popular-library.io goes down or gets hacked? Or how about attack vectors like DNS poisoning? or government-based firewalls? I

My concern is what happens when popular-library.io goes down or gets hacked? Or how about attack vectors like DNS poisoning? or government-based firewalls? I know there's this[1], but somehow I still feel uneasy because the web is so fragile and ephemeral... At the very least I would like to have the standard library offline... [1] https://github.com/denoland/deno/blob/master/docs/linking_to_external_code.md https://github.com/denoland/deno/blob/master/docs/linking_to...

mekster 6y ago
> what happens when popular-library.io goes down or gets hacked? What is anyone going to do about it? Anything has a chance of getting hacked or goes down just when you need it, be it GitHub, npmjs.org... Blaming the tool for not having a protection against DNS poisoning is a bit far fetched.
- xevrem 6y ago
  ultimately i guess it is about how/if deno caches its imports. with node.js/npm you have the exact same problems, just the source & sink occur at different places (package installation)
  - z3t4 6y ago
    With Node.js you install the packages in a dev environment, and test extensively, then push all the code, including node_packages folder to production. Running npm on the prod server is forbidden. At least in theory =)
TechBro8615 6y ago
Do you also share these concerns about golang? Isn’t it basically the same system?
- kminehart 6y ago
  Golang does have https://proxy.golang.org/ https://proxy.golang.org/, which is fairly recent, but yes this is absolutely a problem in Go. See the "go-bindata" problem.
dbrgn 6y ago
You can always download the scripts and host them yourself, right?