5 ms·
CVEs alert end users that they need to take action to apply updates. That's relevant when a specific npm package contained a known vulnerability. It's not relev
by cjbprime 5y ago
CVEs alert end users that they need to take action to apply updates. That's relevant when a specific npm package contained a known vulnerability. It's not relevant when the npm server contained a known vulnerability. There's nothing a user of npm can do to update the npm server.
CVEs don't just mean "this is a big security problem".
- deleted 5y ago[deleted]
- marcus_holmes 5y agohehe... CVE: "the entire javascript/ruby/python development model is insecure" affected: "the whole damn internet" resolution:"rewrite the last 10 years of internet developmet from scratch" not sure that's gonna happen
- rbanffy 5y agoAt least the npm packages outside their telemetry horizon should be updated immediately.