3 ms·

Distributions like Debian are very trustworthy especially when compared to NPM.

• lucideer 5y ago
  Debian has ~20,000-30,000 packages total. NPM has well over a million. Contribution frequency and overall contributor numbers are also much much higher. NPM is a victim of ease of use and popularity. It's a bigger target. But both systems would benefit from a holistic approach to supply chain security.
  • tonyedgecombe 5y ago
    Part of the problem there is JS doesn't have much of a standard library so everybody and their dog tries to fill that hole.
• codedokode 5y ago
  Sadly, in Debian every package which gets installed, can run a script with root privileges so this is even more dangerous. Although most packages don't need such privileges.
  • goodpoint 5y ago
    Nonsense. Package managers need to be able to run scripts as root to do the installation. And yet, in the last 25 or 30 years there's never been a case of a malicious contributor successfully inserting a backdoor in the installation script of any package in any major distribution. Because there is a vetting process, nothing else. [And yes, of course, it would be possible to sandbox each package installation to access some very specific paths but so far it's really unnecessary]