3 ms·
What you're working on must be very sensitive if you can't trust Typescript. From my point of view, Microsoft already has VS Code and Github so...
by dominicrose 2y ago
What you're working on must be very sensitive if you can't trust Typescript.
From my point of view, Microsoft already has VS Code and Github so...
- rini17 2y agoIt pulls so many dependencies and the npm situation is frequent topic of conversation here. And the hype makes it attractive target. No idea how MS and Gihub relate to that.
- 0x1ceb00da 2y agoA few years ago some guy demonstrated how vulnerable the NPM ecosystem is but NPM chose to shoot the messenger instead of fixing the problem. Makes me think that the three letter agencies want the software to be vulnerable to make their job easier.
- hahn-kev 2y agoYou say they chose not to fix it like it's a simple problem with an obvious solution
- paulryanrogers 2y agoCan you point out some examples of NPM shooting messengers? I recall mostly silence and new security controls appearing (albeit opt in) in response to the crisis.
- Shacklz 2y agoWhat exactly are you referring to? Specifically typescript has zero dependencies. Generally speaking, I agree, the npm-ecosystem still has this pervasive problem that pulling one package can result in many transitive dependencies, but a growing amount of well-known packages try to keep it as limited as possible. Looking at the transitive dependency graph is definitely good (necessary) hygiene when picking dependencies, and when done rigorously enough, there shouldn't be too many bad surprises, at least in my personal experience.
- rini17 2y agoOh that must have changed. `npm install typescript` output was totally scary some year or so ago.
- fuzzy2 2y agoTypescript-the-compiler has exactly zero dependencies. But maybe that's now what you were referring to…?