4 ms·

> Essentially every open source software license points out that the code is made available with no warranty at all. Modern package managers need to be designed

> Essentially every open source software license points out that the code is made available with no warranty at all. Modern package managers need to be designed to expect and mitigate this risk. It's almost like the package manager's job has become to protect users from their dependencies.

smt88 5y ago
It is very reasonable to ask NPM, owned by mega-giant tech firm Microsoft, to protect users from malicious packages.
kardianos 5y ago
Package managers should not intentionally expose users to new versions without explicit action. Go modules did different then npm, and I argue Go modules did it correctly.
- pmoleri 5y ago
  Until the opposite happens. Some big security hole is fixed in the dependency, npm gets the fixed version by default while Go is stuck in the tested unsecure version. Or Go mitigates the somehow?
  - jrockway 5y ago
    Go doesn't mitigate that somehow. You get the code that you specify, not the code that someone else has decided is better. In practice, for both npm and Go dependencies, you'll get a Dependabot PR that upgrades the dependency for you. Obviously that is Github-specific, so if you're on a different platform, you'll have to subscribe to security updates in some other way. I am guessing there are many services that you can subscribe to that do the same thing.
  - bhedgeoser 5y ago
    Some big security hole is introduced in one of thousands of dependencies, npm gets the insecure version on next npm install while Go is stuck in the tested secure version. How difficult is that to see? I'm not the one to believe in conspiracy theories but this is just nuts.
  - MattPalmer1086 5y ago
    Until the secure version is tested, as it should be for anything you deploy to production. I'm not sure why you think deploying untested updates is a good idea?
- smasher164 5y ago
  I agree that Go made the right call with MVS. It's a nice compromise between pinning and fetching the latest version of everything.
selfhoster11 5y ago
Protecting users from their dependencies should be the job of their language's standard library. With a good enough stdlib, the number of dependencies required is much lower.

smt88 5y ago

It is very reasonable to ask NPM, owned by mega-giant tech firm Microsoft, to protect users from malicious packages.

kardianos 5y ago

Package managers should not intentionally expose users to new versions without explicit action. Go modules did different then npm, and I argue Go modules did it correctly.

pmoleri 5y ago
Until the opposite happens. Some big security hole is fixed in the dependency, npm gets the fixed version by default while Go is stuck in the tested unsecure version. Or Go mitigates the somehow?
- jrockway 5y ago
  Go doesn't mitigate that somehow. You get the code that you specify, not the code that someone else has decided is better. In practice, for both npm and Go dependencies, you'll get a Dependabot PR that upgrades the dependency for you. Obviously that is Github-specific, so if you're on a different platform, you'll have to subscribe to security updates in some other way. I am guessing there are many services that you can subscribe to that do the same thing.
- bhedgeoser 5y ago
  Some big security hole is introduced in one of thousands of dependencies, npm gets the insecure version on next npm install while Go is stuck in the tested secure version. How difficult is that to see? I'm not the one to believe in conspiracy theories but this is just nuts.
- MattPalmer1086 5y ago
  Until the secure version is tested, as it should be for anything you deploy to production. I'm not sure why you think deploying untested updates is a good idea?
smasher164 5y ago
I agree that Go made the right call with MVS. It's a nice compromise between pinning and fetching the latest version of everything.

selfhoster11 5y ago

Protecting users from their dependencies should be the job of their language's standard library. With a good enough stdlib, the number of dependencies required is much lower.