5 ms·

>So… no more open source? No more random-source. And no more "automatically pull from master, then build & deploy".

• djbusby 5y ago
  Just pipe curl to bash ;)
• tbrownaw 5y ago
  Well, maybe no more "pull someone else's master and build without scanning". Inside a walled garden / from specific people you trust should be fine. Some automated scanning could maybe be ok-ish at least sometimes.
  • deleted 5y ago
    [deleted]
• CodeWriter23 5y ago
  This is why I commit node_modules to my own repos.
  • 0des 5y ago
    Unless you are reviewing the code in your assumedly large bundle of dependencies there, this is not a solution if you weren't posting this in jest
    • CodeWriter23 5y ago
      Not in jest. Still using node_modules from before these stunts started to occur. I recognize I am accepting risk. What I am avoiding is the surprise of a ^version-compatible file introducing new and unwanted “features”.
      • pabs3 5y ago
        What do you do for security updates? There are a lot of them for NPM modules. Seems GitHub manages the database for those now: https://github.com/advisories https://github.com/advisories
        • ficklepickle 5y ago
          I swear 99% of them are prototype pollution or regex DOS that don't apply to how I'm using the dependency.
          • 0des 5y ago
            See, now I can only assume you are playing with our emotions. You got the forehead vein going at first though so I'll give you that.
          • pabs3 5y ago
            What about the 1% that delete data or allow for code execution?
        • CodeWriter23 5y ago
          Snapshot VM, npm install
          • pabs3 5y ago
            And how do you know that is safe and hasn't exfiltrated all your data or used a VM escape exploit.
      • 0des 5y ago
        Even then, if undocumented functionality is waiting for a certain day or certain action for something to execute you have no way in asserting one way or the other if it is safe because you haven't reviewed it.