5 ms·

Node the technology can be used without blindly relying on the update features of npm. Vet your dependency trees, lock your dependency versions at patch level a

Node the technology can be used without blindly relying on the update features of npm. Vet your dependency trees, lock your dependency versions at patch level and use dependency cooldown. This is something you also need to do with package managers in other languages, mind you.

jacquesm 11mo ago
If everybody in your country drives on the right side of the road you could theoretically drive on the left. But you won't get very far like that. People use Node because of the availability of the packages, not the other way around.
- cluckindan 11mo ago
  That’s not a very good analogy. Doing what I suggested is not illegal and doesn’t prevent you from using packages from npm. It’s more akin to due diligence: before driving, you check that your car is safe to drive. At the gas and service station, you choose the proper fuel, proper lubricants and spare parts from a reputable vendor which are appropriate for your car.
  - jacquesm 11mo ago
    Nobody - and I mean absolutely nobody - using Node.js has fully audited all of the dependencies they use and if we find somewhere in a cave a person that did that they are definitely not going to do it all over again when something updates.
    - cluckindan 11mo ago
      I can guarantee that any financial institution which has standard auditing requirements and is using Node.js has fully audited all of the dependencies they use. Outside that, the issue is not unique to Node.js.
      - jacquesm 11mo ago
        Sorry, but that had me laughing out loud. No, they haven't. I should know, I check those companies for a living. This is one of the most often flagged issues: unaudited Node.js dependencies. "Oh but we don't have the manpower to do that, think about how much code that is".
        DamonHD 11mo ago
        When I last looked (as a consulting dev in a bank or three, horrified) absolutely they had not!
        cluckindan 11mo ago
        If this was in the US, all financial institutions need to audit their code to comply with NIST SP 800-53. If they haven’t, it would be ethically dubious for you to not report it.
        DamonHD 11mo ago
        These were all multinationals, with very significant US presence.
        drw85 11mo ago
        In my experience, most devs and companies don't consider the dependencies they load 'their' code. They only look at the code they write, not everything they deploy.
        jacquesm 11mo ago
        In theory there is no difference between theory and practice, but in practice there is. > If they haven’t, it would be ethically dubious for you to not report it. I can report all I want, someone needs to act on that report for it to have an effect. There are people out there who think that some static analysis tool plugged into their CI/CD pipeline is the equivalent of a code audit.
- prmph 11mo ago
  > People use Node because of the availability of the packages, not the other way around. That is not why I use Node. Incidentally, I also use Bun.js, and pnpm for most package management operations. I also use Typescript instead of raw JS. I use Node and these related tools fundamentally because: - I like the isomorphism of the code I write (same language for server and client) - JS may have many warts, but IMO it has many advantages many other languages lack, it is rapidly improving, and TS makes it even more powerful and the bad part parts manageable. One ting that has stuck with me over the many years of using JS/TS is just how direct and free-of-ceremony everything is. Want a functional style? It supports it to some extent without much fuss. Want something akin to OOP? You can object literal with method-style function, "constructors" that are regular functions, even no-fuss prototypical inheritance, if you want to go that far. Also, no need for any complicated dependency injection (DI), you can just implement pure DI with regular functions, etc. I don't get why you hate JS/TS so much. - I use Bun.js as an alternative to Node that has more batteries included, so that I can limit my exposure to too many external packages. I add packages only if I absolutely need them, and I audit them thoroughly. So, no, although I may use some packages, I am not on the Node ecosystem just because I want to go on a package consumption spree. - I use pnpm for installing and managing package, and it by default prevents packages from taking any actions during installation; I just get their code.
  - jacquesm 11mo ago
    Would you consider your use cases typical for the average Node.js ecosystem denizen?

jacquesm 11mo ago

If everybody in your country drives on the right side of the road you could theoretically drive on the left. But you won't get very far like that. People use Node because of the availability of the packages, not the other way around.

cluckindan 11mo ago
That’s not a very good analogy. Doing what I suggested is not illegal and doesn’t prevent you from using packages from npm. It’s more akin to due diligence: before driving, you check that your car is safe to drive. At the gas and service station, you choose the proper fuel, proper lubricants and spare parts from a reputable vendor which are appropriate for your car.
- jacquesm 11mo ago
  Nobody - and I mean absolutely nobody - using Node.js has fully audited all of the dependencies they use and if we find somewhere in a cave a person that did that they are definitely not going to do it all over again when something updates.
  - cluckindan 11mo ago
    I can guarantee that any financial institution which has standard auditing requirements and is using Node.js has fully audited all of the dependencies they use. Outside that, the issue is not unique to Node.js.
    - jacquesm 11mo ago
      Sorry, but that had me laughing out loud. No, they haven't. I should know, I check those companies for a living. This is one of the most often flagged issues: unaudited Node.js dependencies. "Oh but we don't have the manpower to do that, think about how much code that is".
      - DamonHD 11mo ago
        When I last looked (as a consulting dev in a bank or three, horrified) absolutely they had not!
        cluckindan 11mo ago
        If this was in the US, all financial institutions need to audit their code to comply with NIST SP 800-53. If they haven’t, it would be ethically dubious for you to not report it.
        DamonHD 11mo ago
        These were all multinationals, with very significant US presence.
        drw85 11mo ago
        In my experience, most devs and companies don't consider the dependencies they load 'their' code. They only look at the code they write, not everything they deploy.
        jacquesm 11mo ago
        In theory there is no difference between theory and practice, but in practice there is. > If they haven’t, it would be ethically dubious for you to not report it. I can report all I want, someone needs to act on that report for it to have an effect. There are people out there who think that some static analysis tool plugged into their CI/CD pipeline is the equivalent of a code audit.
prmph 11mo ago
> People use Node because of the availability of the packages, not the other way around. That is not why I use Node. Incidentally, I also use Bun.js, and pnpm for most package management operations. I also use Typescript instead of raw JS. I use Node and these related tools fundamentally because: - I like the isomorphism of the code I write (same language for server and client) - JS may have many warts, but IMO it has many advantages many other languages lack, it is rapidly improving, and TS makes it even more powerful and the bad part parts manageable. One ting that has stuck with me over the many years of using JS/TS is just how direct and free-of-ceremony everything is. Want a functional style? It supports it to some extent without much fuss. Want something akin to OOP? You can object literal with method-style function, "constructors" that are regular functions, even no-fuss prototypical inheritance, if you want to go that far. Also, no need for any complicated dependency injection (DI), you can just implement pure DI with regular functions, etc. I don't get why you hate JS/TS so much. - I use Bun.js as an alternative to Node that has more batteries included, so that I can limit my exposure to too many external packages. I add packages only if I absolutely need them, and I audit them thoroughly. So, no, although I may use some packages, I am not on the Node ecosystem just because I want to go on a package consumption spree. - I use pnpm for installing and managing package, and it by default prevents packages from taking any actions during installation; I just get their code.
- jacquesm 11mo ago
  Would you consider your use cases typical for the average Node.js ecosystem denizen?