3 ms·

It’s really easy to develop (especially backend) code that doesn’t have this horrible problem. Just use literally any other language. This is neither modern nor

by c0pium 3y ago

It’s really easy to develop (especially backend) code that doesn’t have this horrible problem. Just use literally any other language. This is neither modern nor a reality. Regulation can’t come to this snake oil industry fast enough.

loup-vaillant 3y ago
Another way to see this is that regulation can drastically change "modern reality". Require a software bill of materials and the NPM dependency nightmare will soon cease to be a reality.
- c0pium 3y ago
  I’ve heard this before, but I don’t understand why people think this. Having an SBOM for a lovecraftian horror won’t make it less of a horror, and it will give people something to point at and say “it must be safe, it’s got this cryptography stuff!”
  - loup-vaillant 3y ago
    What I’m saying is, with the SBOM you get to see the Lovecraftian horror, and it such a drag and a time sink to properly trace the transitive closure of all your dependencies that soon, you end up thinking of maybe having fewer of them. Besides, I’m of the opinion that knowing your dependencies is a requirement for all serious software. (Meaning, if you’re not already tracking your dependencies, you are not taking your own software seriously.)
nobodyandproud 3y ago
Is it though? Maybe other platforms don’t have the same scale of horribleness as the web stacks, but there’s still a problem. For the dotnet ecosystem, for instance, I’m not reinventing functionality when nuget packages exist. But the same concerns persist because I’m not really sure if it’s secure, without auditing.
- c0pium 3y ago
  Yes.
  - nobodyandproud 3y ago
    No. Your position needs some explanation, because dependency hell was a problem long before the NodeJS stack. Both from a security and compatibility perspective, it's not a solved problem because it's not a problem specific to any tech stack.

by c0pium 3y ago

loup-vaillant 3y ago

Another way to see this is that regulation can drastically change "modern reality". Require a software bill of materials and the NPM dependency nightmare will soon cease to be a reality.

c0pium 3y ago
I’ve heard this before, but I don’t understand why people think this. Having an SBOM for a lovecraftian horror won’t make it less of a horror, and it will give people something to point at and say “it must be safe, it’s got this cryptography stuff!”
- loup-vaillant 3y ago
  What I’m saying is, with the SBOM you get to see the Lovecraftian horror, and it such a drag and a time sink to properly trace the transitive closure of all your dependencies that soon, you end up thinking of maybe having fewer of them. Besides, I’m of the opinion that knowing your dependencies is a requirement for all serious software. (Meaning, if you’re not already tracking your dependencies, you are not taking your own software seriously.)

nobodyandproud 3y ago

Is it though? Maybe other platforms don’t have the same scale of horribleness as the web stacks, but there’s still a problem. For the dotnet ecosystem, for instance, I’m not reinventing functionality when nuget packages exist. But the same concerns persist because I’m not really sure if it’s secure, without auditing.

c0pium 3y ago
Yes.
- nobodyandproud 3y ago
  No. Your position needs some explanation, because dependency hell was a problem long before the NodeJS stack. Both from a security and compatibility perspective, it's not a solved problem because it's not a problem specific to any tech stack.