2 ms·
I’m not a node/js apologist, but every time there is a vulnerability in NPM package, this opinion is voiced. But in reality it has nothing to do with node/js.
by skwee357 11mo ago
I’m not a node/js apologist, but every time there is a vulnerability in NPM package, this opinion is voiced.
But in reality it has nothing to do with node/js. It’s just because it’s the most used ecosystem. So I really don’t understand the argument of not using node. Just be mindful of your dependencies and avoid updating every day.
- shortrounddev2 11mo agoit's interesting that staying up to date with your dependencies is considered a vulnerability in Node
- skwee357 11mo agoPeople who live on the edge of updates always risk vulnerabilities and incompatibility issues. It’s not about node, but anything software related.
- bichiliad 11mo agoHaving a cooldown is different from never updating. I don’t think waiting a few days is a bad security practice in any environment, node or otherwise.
- vrighter 11mo agoBut only if most of everyone else doesn't do so.
- Aperocky 11mo agoIt has everything to do with node/js. Because the community believes in tiny dependencies that must be updated as often as possible and the tooling reflects that belief.