3 ms·
The chance to fix npm is dwindling quickly. With each year, a culture sets in that will get harder and harder to fix with time. Personally I suspect that the l
by ashtonkem 6y ago
The chance to fix npm is dwindling quickly. With each year, a culture sets in that will get harder and harder to fix with time.
Personally I suspect that the lefpad debacle might have been the point of no return for npm; the fact that such a simple package managed to break everything g should have been a wake up call, but it does not appear that the community fixed much.
- harikb 6y agoWhat could potentially happen with a malicious dependency added knowingly by the original author or unknowingly because his account is compromised will one day make leftpad look like a harmless warning / near escape we ignored. Sure, leftpad broke productivity for one day. But the continued willful ignorance we show towards "yet another dependency" will kill us one day. There is work happening in creating notary etc. Github/Microsoft is in a very good position to solve this. I hope they take the opportunity.
- quantummkv 6y agoThe sad thing is that it already happened 2 years ago [1]. And nothing changed apart from some general apathy on the interwebs. The JavaScript ecosystem is past the point of no return right now. Any improvements will only be band-aids. [1] - https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets https://www.trendmicro.com/vinfo/dk/security/news/cybercrime...