4 ms·
This is the price of free code. If you don't read the open source you're adding to your system then don't complain when it owns you! You wouldn't take your medi
by ipnon 5y ago
This is the price of free code. If you don't read the open source you're adding to your system then don't complain when it owns you! You wouldn't take your medicine without reading the label first.
NPM is a miracle for open software development, but it requires diligence.
- trog 5y agoWeird comparison. The equivalent with medicine is not 'reading the label', but understanding the chemistry, reading all the research, reading all the associated papers, understanding all the biology, etc. It's reduced to you needing to only read the label by regulation. Expecting people to read the source of their dependencies, outside of very specific use cases and industries, is a lost cause.
- shukantpal 5y agoThe difference is that NPM packages are provided for free.
- Zababa 5y agoMany drugs are free or almost free where I live. Well, not really free, they're paid by our taxes. And npm is paid by Microsoft not paying theirs. So the difference isn't so big.
- shukantpal 5y ago"And npm is paid by Microsoft not paying theirs." LOL ok.
- maccolgan 5y agoImagine if you needed a doctoral degree and a billion dollar FDA study before being able to publish open source code.
- LinuxBender 5y agoUnless these are compiled binaries it should be fairly easy to spot funny-business. Surely someone out there must do diffs on version updates to see what changed. I know that I am nosey enough to see what changes people made rather than relying on change logs. Either way it would be nice if NPM devs signed their scripts. Nothing as complex as rpm/deb packages, just corresponding .asc files might be useful for the small handful of people that validate signatures. Or if public key management is a PITA and too much friction, then even a signed manifest file on a trusted origin server vs. mirrors could be super handy. The code deployment systems could curl the manifest and at least validate the checksums of the files.
- foota 5y agoI'm surprised there isn't some machine learning system for this.
- bombcar 5y agoAmusingly enough I guarantee you that 90%+ of people only ever read the label on their medication when there’s absolutely nothing else to read in the bathroom. It’s assumed the doctors and the pharmacist have done the reading for you.