3 ms·
Using the Node ecosystem for frontend development feels riskier every day, but at least the attack surface there is limited to development machines and the brow
by smokel 2y ago
Using the Node ecosystem for frontend development feels riskier every day, but at least the attack surface there is limited to development machines and the browser sandbox. I can sort of live with that. But I have a hard time finding trust in using it for backend processes.
In, say, the JVM or .NET ecosystems one can limit their dependencies to a handful of libraries that come from reputable sources. What is keeping us from folding some of the basic JavaScript libraries into a few larger ones?
And even more importantly, what evolutional forces have brought us into this state? Is it that frontend developers are more extraverted and share their inferior creations more actively? Are frontend developers more obsessed with shiny new things because they work on the visible parts of software development? Would understanding this help with finding a nice way forward?
- wouldbecouldbe 2y agoWhat's your main concern, the npm modules?
- gardnr 2y agoIf you don't `npm config set ignore-scripts true` then you are basically executing random unknown code every time you do an `npm install`. Modules can change hands and become malicious, which is much more plausible when there are thousands of sub-dependencies in a pretty standard modern web app.
- smokel 2y agoMy main concern is the impossibility of finding trust in library dependencies. A typical React app has somewhere over 2,000 packages from almost as many different sources. It is impossible to check the reputability of each contributor. I'm aware of things like "npm audit", but with the amount of false positives that spews out, it seems one just has to trust the entire ecosystem. My intuition keeps telling me that this is a disaster waiting to happen, and I'm trying to understand how this can be so pervasive.
- deleted 2y ago[deleted]