4 ms·
npm wasn't built with security in mind. npm doesn't implement permissions. node doesn't implement permissions. deno does have slightly more emphasis on securi
by 29athrowaway 6y ago
npm wasn't built with security in mind.
npm doesn't implement permissions. node doesn't implement permissions.
deno does have slightly more emphasis on security, but JavaScript is not and will never be a security focused language. Everything is mutable, even type definitions.
- turminal 6y agoI think it's possible (and not impossibly hard) to overcome the security shortcomings of the language, but the real problem is persuading the ecosystem (starting with its leaders that design core libraries and infrastructure like npm) that security is something they should care about. The way javascript ecosystem designs its products affects basically everyone with an internet connection. It's almost like they had a moral responsibility to improve themselves.