3 ms·

> IMO, every software dev using node, with endless thousands of packages, all with unknown licenses, and with unknown origins, unaudited, and by default, the ab

> IMO, every software dev using node, with endless thousands of packages, all with unknown licenses, and with unknown origins, unaudited, and by default, the ability to execute scripts and code during install... And which if you audit all those packages, 10 seconds later they could be sold/stolen/hijacked for malicious intent... Yet devs think this is awesome... Like most devs (or engineering managers), I’m resigned to modern realities. It’s a race to the bottom and I’ve been dragged into flame wars by smug (and very wrong) engineers who believed semantic versioning would solve compatibility problems and the like. It’s impossible to justify the cost of full auditing and ground-up building. The only way to solve this is to force ground rules.

c0pium 3y ago
It’s really easy to develop (especially backend) code that doesn’t have this horrible problem. Just use literally any other language. This is neither modern nor a reality. Regulation can’t come to this snake oil industry fast enough.
- loup-vaillant 3y ago
  Another way to see this is that regulation can drastically change "modern reality". Require a software bill of materials and the NPM dependency nightmare will soon cease to be a reality.
  - c0pium 3y ago
    I’ve heard this before, but I don’t understand why people think this. Having an SBOM for a lovecraftian horror won’t make it less of a horror, and it will give people something to point at and say “it must be safe, it’s got this cryptography stuff!”
    - loup-vaillant 3y ago
      What I’m saying is, with the SBOM you get to see the Lovecraftian horror, and it such a drag and a time sink to properly trace the transitive closure of all your dependencies that soon, you end up thinking of maybe having fewer of them. Besides, I’m of the opinion that knowing your dependencies is a requirement for all serious software. (Meaning, if you’re not already tracking your dependencies, you are not taking your own software seriously.)
- nobodyandproud 3y ago
  Is it though? Maybe other platforms don’t have the same scale of horribleness as the web stacks, but there’s still a problem. For the dotnet ecosystem, for instance, I’m not reinventing functionality when nuget packages exist. But the same concerns persist because I’m not really sure if it’s secure, without auditing.
  - c0pium 3y ago
    Yes.
    - nobodyandproud 3y ago
      No. Your position needs some explanation, because dependency hell was a problem long before the NodeJS stack. Both from a security and compatibility perspective, it's not a solved problem because it's not a problem specific to any tech stack.

c0pium 3y ago

It’s really easy to develop (especially backend) code that doesn’t have this horrible problem. Just use literally any other language. This is neither modern nor a reality. Regulation can’t come to this snake oil industry fast enough.

loup-vaillant 3y ago
Another way to see this is that regulation can drastically change "modern reality". Require a software bill of materials and the NPM dependency nightmare will soon cease to be a reality.
- c0pium 3y ago
  I’ve heard this before, but I don’t understand why people think this. Having an SBOM for a lovecraftian horror won’t make it less of a horror, and it will give people something to point at and say “it must be safe, it’s got this cryptography stuff!”
  - loup-vaillant 3y ago
    What I’m saying is, with the SBOM you get to see the Lovecraftian horror, and it such a drag and a time sink to properly trace the transitive closure of all your dependencies that soon, you end up thinking of maybe having fewer of them. Besides, I’m of the opinion that knowing your dependencies is a requirement for all serious software. (Meaning, if you’re not already tracking your dependencies, you are not taking your own software seriously.)
nobodyandproud 3y ago
Is it though? Maybe other platforms don’t have the same scale of horribleness as the web stacks, but there’s still a problem. For the dotnet ecosystem, for instance, I’m not reinventing functionality when nuget packages exist. But the same concerns persist because I’m not really sure if it’s secure, without auditing.
- c0pium 3y ago
  Yes.
  - nobodyandproud 3y ago
    No. Your position needs some explanation, because dependency hell was a problem long before the NodeJS stack. Both from a security and compatibility perspective, it's not a solved problem because it's not a problem specific to any tech stack.