4 ms·
It is a problem because it creates a trust vector between the binary vendor and the app developer consuming the binary. Sure, there is going to be a build-your
by eurasiantiger 4y ago
It is a problem because it creates a trust vector between the binary vendor and the app developer consuming the binary.
Sure, there is going to be a build-your-own kit, but is everyone going to audit the codebase and the tooling and all dependencies?
It’s a fresh new can of worms and we’re already overstocked.
- nullfield 4y agoThere’s already a trust vector between the people shipping all the tiny little pieces of garbage JS, and then on to the binaries that read and handle dependency management, and packaging, and so on-things which, as has been expressed, seem to be in a rolling two-years-or-less handbasket to at least “mess”, if not “hell”. We’re already to the point where “no one” audits the code base, tooling, or dependencies. Especially the dependencies.
- klysm 4y agoI really don’t think deserializing the file is that sketchy. It’s really not hard to implement a parser if the format isn’t garbage