3 ms·
> I like using package managers, but they can be quite dangerous I'm curious to hear what you think is dangerous about package managers. I'm assuming you're re
by michaelmior 4y ago
> I like using package managers, but they can be quite dangerous
I'm curious to hear what you think is dangerous about package managers. I'm assuming you're referring to left-pad and similar situations.
- ChrisMarshallNY 4y agoIt's because it's possible to obfuscate the provenance of some packages. You can do the same thing with submodules, but it's more difficult. Like I said, I'm a control freak. Packages are fine, as long as they're mine.
- michaelmior 4y agoI'm curious what you mean about obfuscating provenance. Most package managers download the package from a specific source and will allow you to store the hash of that package in your repository.
- ChrisMarshallNY 4y agoThe whole deal with packages, is to make it really, really easy to discover and integrate them, without having to worry about where they came from, or who has had their fingers in the pie. It's [theoretically] possible to find out, but I have never met anyone that admits to vetting their dependencies in anything near complete fashion. Most look at "buzz" around the package, and at how many stars it has. That's wonderful. So is going out clubbing, and "getting to know" a whole bunch of different folks that you meet randomly. Both can have unfortunate side effects. It's entirely possible to do so safely, but Christian coffeehouses might not be your idea of a good time on Saturday night. But nothing is perfect, and a dedicated blackhat can leverage just about anything.