2 ms·
Unfortunately `npm i` has the same power. `go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install o
by yencabulator 3y ago
Unfortunately `npm i` has the same power.
`go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time.
I think we need better tooling for working in sandboxes, to at least compartmentalize the explosion. ChromeOS's "virtual machines can open Wayland windows on the main desktop" trick is neat, but the code needed to do that was less than clean or reusable when I last looked.
- remram 3y agoWhat's the point? You're going to ship that code to your users, or run it against your production database. If you think it might be malicious, protecting the dev laptop shouldn't be the priority.
- yencabulator 3y agoI run production services that don't even talk to a database, or that have minimal read-only access. And even for the ones with a lot of write access, having the database stolen/nuked (to be restored from backup) is quite different from handing over all of my browser cookies, or my gcloud/aws/k8s ambient authority credentials that are just sitting in a file (seriously, why is big cloud client security worse than SSH).
- remram 3y agoFair enough, some organizations might have devs with limited access, but you're right I can see a lot of situations where the dev laptop has strictly larger blast area.
- richbell 3y ago> `go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time. Maven is the same way, AFAIK.