3 ms·

No offense, but who made this? How did the submitter find this? The Download page has a name but a Google search doesn’t return much. Not that anyone would run

No offense, but who made this? How did the submitter find this? The Download page has a name but a Google search doesn’t return much. Not that anyone would run a binary just like that, but I do find it interesting.

mlhpdx 3y ago
I hope developers are among the most careful about putting new things on their systems. I hope.
- yjftsjthsd-h 3y ago
  > I hope. I have... simply the worst of news.
  - varelse 3y ago
    [dead]
- solardev 3y ago
  I usually read most of the description's first sentence before downloading a npm package. Does that count?
- vundercind 3y ago
  Nah, we can’t work without admin on our system because we need to install 100 programs we’ve never really vetted, a couple of which have been out of support for a decade. How else are we going to efficiently add 20,000 lines of code we haven’t read as dependencies to our project… this week? We’d love to do things safer but it’s not in the sprint plan, which plan assumes speed only possible if you use third party tools and code you haven’t properly vetted for basically everything. Never mind that then you slow to a halt when infosec sees a CVE rate of ten a week against all those packages you had to have, often against ones you’re not even using but are a dep-of—a-dep for some optional functionality you don’t invoke, and now your team spends 80 person-hours a week addressing those and messaging about doing those and having code reviews of one-line dep version bumps and running regression tests and moving them through the deployment pipeline (we’re Responsible and Safe, as you can plainly see, so of course we have at least three multi-step stages to get to deployment, wouldn’t want to be unsafe!), all because we want to “move fast” but also “be safe” (but not at the same time, so the left hand doesn’t know what the right hand’s doing until everything’s already all fucked up) (Sigh)
redman25 3y ago
Hey, I'm OP. I did not write this blog post. It was an interesting one from r/programmers that I felt worth cross-posting to HN. Not sure if there's a clear way to indicate that in the title... Here's the original reddit post: https://www.reddit.com/r/programming/comments/1c8yhll/i_cant_stand_using_vscode_so_i_wrote_my_own_it/ https://www.reddit.com/r/programming/comments/1c8yhll/i_cant...
- skilled 3y ago
  ok, thanks

mlhpdx 3y ago

I hope developers are among the most careful about putting new things on their systems. I hope.

yjftsjthsd-h 3y ago
> I hope. I have... simply the worst of news.
- varelse 3y ago
  [dead]
solardev 3y ago
I usually read most of the description's first sentence before downloading a npm package. Does that count?
vundercind 3y ago
Nah, we can’t work without admin on our system because we need to install 100 programs we’ve never really vetted, a couple of which have been out of support for a decade. How else are we going to efficiently add 20,000 lines of code we haven’t read as dependencies to our project… this week? We’d love to do things safer but it’s not in the sprint plan, which plan assumes speed only possible if you use third party tools and code you haven’t properly vetted for basically everything. Never mind that then you slow to a halt when infosec sees a CVE rate of ten a week against all those packages you had to have, often against ones you’re not even using but are a dep-of—a-dep for some optional functionality you don’t invoke, and now your team spends 80 person-hours a week addressing those and messaging about doing those and having code reviews of one-line dep version bumps and running regression tests and moving them through the deployment pipeline (we’re Responsible and Safe, as you can plainly see, so of course we have at least three multi-step stages to get to deployment, wouldn’t want to be unsafe!), all because we want to “move fast” but also “be safe” (but not at the same time, so the left hand doesn’t know what the right hand’s doing until everything’s already all fucked up) (Sigh)

redman25 3y ago

Hey, I'm OP. I did not write this blog post. It was an interesting one from r/programmers that I felt worth cross-posting to HN. Not sure if there's a clear way to indicate that in the title... Here's the original reddit post: https://www.reddit.com/r/programming/comments/1c8yhll/i_cant_stand_using_vscode_so_i_wrote_my_own_it/ https://www.reddit.com/r/programming/comments/1c8yhll/i_cant...

skilled 3y ago
ok, thanks