3 ms·
The business case for accepting the risk of downloading untrusted software has proven time and time again to be worth it. Without NPM modules, time to deliver w
by JMTQp8lwXL 6y ago
The business case for accepting the risk of downloading untrusted software has proven time and time again to be worth it. Without NPM modules, time to deliver would be much, much longer. If it was that bad of a problem, we would've collectively moved away. Many companies privately invest in their own registries that proxy to NPM, with an intermediary security layer. The maintainers of NPM have shown they'll cleanup the left-pad's and major security issues when they occur.
- goatinaboat 6y agoWithout NPM modules, time to deliver would be much, much longer. This is a circular argument. “We chose a language that has millions of tiny dependencies now we need a tool to manage millions of tiny dependencies”
- JMTQp8lwXL 6y agoIf you must ship JavaScript for the web, you don't have much of a choice in languages (you might choose a superset like TypeScript, which is still distributed via the NPM ecosystem). For server-side code, agreed. You don't have to choose Node.js or JavaScript or NPM there.