3 ms·

It's not really conceptually different from relying on third party libraries in any context. I haven't touched JavaScript since the late 90s, so I dunno what t

by TillE 5y ago

It's not really conceptually different from relying on third party libraries in any context. I haven't touched JavaScript since the late 90s, so I dunno what the hell's going on there, but in my C++ projects I typically have 10-20 dependencies (counting modularized Boost as one). They're either built by a custom script which includes the SHA256 of the tarballs it expects, or by a particular pinned commit of vcpkg which likewise uses SHA512 to verify its downloads. I generally only update these when I need a new feature or bug fix, which means I'm unlikely to get bitten by any temporary security compromise. If the "particular checkout of vcpkg" type of approach is impossible with other package managers, that's unfortunate.

cnorthwood 5y ago
Fortunately this is the default in JavaScript world with both Yarn and NPM supporting lockfiles which have hashes and pinned versions. The problem is the sheer volume of dependencies and transient dependencies which makes it hard to reliably audit those, as updating one thing can cause a lot of work.
SavantIdiot 5y ago
> I haven't touched JavaScript since the late 90s, so I dunno what the hell's going on there, Well you're in for a surprise: the entire web is built on JavaScript for one thing. And that is build on frameworks which are built on ... other frameworks, which are built on a ginormous repository typically accessed by npm/yarn. npm modules aren't the same as boost. Boost is written and scrutinized by some of the best C++ minds on the planet. npm modules are written by anyone. they are all open source, but so many are in use that i doubt they get the scrutiny they deserve. at one point there was a package just to left-align things and a bug in it broke thousands of services. but that's the landscape the modern web is built on, for better or for worse.
- nathanaldensr 5y ago
  I believe you're referring to "left-pad," but I think the author actually deleted the package and that's why the dependency chain broke.
  - SavantIdiot 5y ago
    Yes, that's it! Thank you for clarifying.
stillblue 5y ago
> I haven't touched JavaScript since the late 90s Can I come live with you? It's sad that I'm only half joking.

by TillE 5y ago

cnorthwood 5y ago

Fortunately this is the default in JavaScript world with both Yarn and NPM supporting lockfiles which have hashes and pinned versions. The problem is the sheer volume of dependencies and transient dependencies which makes it hard to reliably audit those, as updating one thing can cause a lot of work.

SavantIdiot 5y ago

> I haven't touched JavaScript since the late 90s, so I dunno what the hell's going on there, Well you're in for a surprise: the entire web is built on JavaScript for one thing. And that is build on frameworks which are built on ... other frameworks, which are built on a ginormous repository typically accessed by npm/yarn. npm modules aren't the same as boost. Boost is written and scrutinized by some of the best C++ minds on the planet. npm modules are written by anyone. they are all open source, but so many are in use that i doubt they get the scrutiny they deserve. at one point there was a package just to left-align things and a bug in it broke thousands of services. but that's the landscape the modern web is built on, for better or for worse.

nathanaldensr 5y ago
I believe you're referring to "left-pad," but I think the author actually deleted the package and that's why the dependency chain broke.
- SavantIdiot 5y ago
  Yes, that's it! Thank you for clarifying.

stillblue 5y ago

> I haven't touched JavaScript since the late 90s Can I come live with you? It's sad that I'm only half joking.