3 ms·

I'm now double and triple checking when I add a package to the manifest. You have to check not only that it's the right package, you also check that it has the

I'm now double and triple checking when I add a package to the manifest. You have to check not only that it's the right package, you also check that it has the number of downloads that you're expecting.

z3t4 4y ago
You should also read the source code. Developers are probably the only profession that blindly trusts their peers.
- scarby2 4y ago
  most engineers blindly trust things when another engineer or vendor has signed off/certified on it. There's simply not enough time in the world to go through the certification date for every single part you use in a project. We trust that there has been a testing process that validates that things do what they say they will do. Admittedly when dealing with non-OSS vendors you can sue them if something goes badly wrong.
- dgb23 4y ago
  It’s perfectly normal to trust your peers in a collaborative setting regardless of the profession. The issue is rather that this is only a largely collaborative one. Which makes the thing kind of worse, because you can _often_ get away with simply trusting everyone and there are economic and practical pressures to do so.
ashishbijlani 4y ago
The problem with using downloads as a proxy for "safety" is that a bad actor can use CI infra/bots/scripts to inflate the number. This is why in Packj [1] we check for multiple attributes (e.g., dependents). 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj
- ok123456 4y ago
  I just tried this and the output is very very very noisy. It treats any dependent package that hasn't been updated in a while as a "RISK" and it manually tries to resolve each github repository (and runs into API request limits).
  - ashishbijlani 4y ago
    We've made it highly customizable [1]. For some folks, a package that has not been updated for a while could be classified as abandonware. You can turn off the alerts that do not apply to you by commenting out in .packj.yaml file. We're working on making it similar to email spam. Will post more soon. Meanwhile, we welcome changes that can make it less noisy for the community. [Edit:] one can specify Github API token to get around rate limiting. We'd deeply appreciate if could create an issue for this on the repo. 1. https://github.com/ossillate-inc/packj#customization https://github.com/ossillate-inc/packj#customization

z3t4 4y ago

You should also read the source code. Developers are probably the only profession that blindly trusts their peers.

scarby2 4y ago
most engineers blindly trust things when another engineer or vendor has signed off/certified on it. There's simply not enough time in the world to go through the certification date for every single part you use in a project. We trust that there has been a testing process that validates that things do what they say they will do. Admittedly when dealing with non-OSS vendors you can sue them if something goes badly wrong.
dgb23 4y ago
It’s perfectly normal to trust your peers in a collaborative setting regardless of the profession. The issue is rather that this is only a largely collaborative one. Which makes the thing kind of worse, because you can _often_ get away with simply trusting everyone and there are economic and practical pressures to do so.

ashishbijlani 4y ago

The problem with using downloads as a proxy for "safety" is that a bad actor can use CI infra/bots/scripts to inflate the number. This is why in Packj [1] we check for multiple attributes (e.g., dependents). 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj

ok123456 4y ago
I just tried this and the output is very very very noisy. It treats any dependent package that hasn't been updated in a while as a "RISK" and it manually tries to resolve each github repository (and runs into API request limits).
- ashishbijlani 4y ago
  We've made it highly customizable [1]. For some folks, a package that has not been updated for a while could be classified as abandonware. You can turn off the alerts that do not apply to you by commenting out in .packj.yaml file. We're working on making it similar to email spam. Will post more soon. Meanwhile, we welcome changes that can make it less noisy for the community. [Edit:] one can specify Github API token to get around rate limiting. We'd deeply appreciate if could create an issue for this on the repo. 1. https://github.com/ossillate-inc/packj#customization https://github.com/ossillate-inc/packj#customization