4 ms·
I'd love to use this. But 34 dependencies? I know ~10 of them are React, and there's some in there that make sense. But I haven't got the time to audit them al
by marcus_holmes 6y ago
I'd love to use this. But 34 dependencies?
I know ~10 of them are React, and there's some in there that make sense. But I haven't got the time to audit them all, and re-audit it every time any of those dependencies update .
And escape-string-regexp? Really? it's literally 2 lines of code [0]. Why have I got to give the maintainer of that project commit access to this program that will be seeing potentially sensitive data?
Why, if the developer couldn't come up with those 2 lines themselves, isn't this a Stack Overflow copy/paste?
[0]https://github.com/sindresorhus/escape-string-regexp/blob/master/index.js https://github.com/sindresorhus/escape-string-regexp/blob/ma...
- halfmatthalfcat 6y agoWould you also criticize someone for using Apache Commons StringUtils? The fetishization of critiquing npm package choices is hilarious.
- marcus_holmes 6y agoyes. And no, it's a major security problem that we're only just beginning to realise is a major security problem.