3 ms·
The thing I hate the most is when some JavaScript library uses some obscure build system (or any build system really) but on GitHub they don't publish the built
by dvh 4y ago
The thing I hate the most is when some JavaScript library uses some obscure build system (or any build system really) but on GitHub they don't publish the built version. What could have been simple download now turns into several hours exercise in trying to understand and make work yet another build system, downloading intermediate bullshit from random websites. Just publish the damn library, thanks.
- cudgy 4y agoTrue, but then how do you know the library was built with the code in the repository? This could introduce a security risk.
- rini17 4y agoAll these build dependencies don't introduce security risk?
- cudgy 4y agoYes, they do. However, accepting pre-built binaries introduces even more risk.
- rini17 4y agoAny basis for your assertion please? Binary infected with malicious payload is more likely to be detected by antivirus or by manual checking of the signature/checksum if user cares to. Infected build system? In case of linux distributions, there are maintainers and packagers responsible for their source and binaries. In case of javascript, does anyone care?