5 ms·
This is fine, right? It's a small price to pay to do, well, whatever it is ya'll like to do with post-install hooks. Now me, I don't really get it. Call me dumb
by phendrenad2 8mo ago
This is fine, right? It's a small price to pay to do, well, whatever it is ya'll like to do with post-install hooks. Now me, I don't really get it. Call me dumb, or a scaredy-cat, but the very idea of giving the hundreds of packages that I regularly install, as necessitated by javascript's lack of a standard library, the ability to run arbitrary commands on my machine, gives me the heebie-jeebies. But, I'm sure you geniuses have SOME really awesome use for it, that I'm simply too dense in the head to understand. I wish I were smart enough to figure it out, but I'm not, so I'll keep suffering these security vulnerabilities, sleeping well at night knowing that it's all worth it because you're all doing amazing, tremendous things with your post-install hooks!
- hunterpayne 8mo agoWithout it, all a package can do is drop files on a filesystem. Its used to do any sort of setup, initialization or registration logic. Its actually impossible to install many packages without something like it. Otherwise, you end up having to follow a bunch of install instructions (which you will mess up sometimes) after each package gets installed.
- phendrenad2 8mo agoI think that helps me understand. What are some examples of things where I'd want initialization or registration? What packages are impossible to install with this, besides cases where npm is used as an alternative to apt/yum to install dev executables?
- hunterpayne 8mo agoCreate registry entries in a config file for all local printers found in the existing OS configuration. Remember that the installer runs with privileges that the application won't normally have. So anytime you have to use those privileges you don't do it at runtime, you do it at install time. And this requires the hook.
- phendrenad2 8mo agoAnd is that worth it? Scanning for printers? In an NPM module? Surely there are better examples somewhere.
- Orygin 8mo agoIf I install a package and it starts scanning my local printers, it get immediately removed and the author put on a blacklist. No other ecosystem is that dense, none of them require such stupid and dangerous flows to work.
- phendrenad2 8mo agoYeah I'm not sure hunterpayne isn't an AI that did some research to answer my question and immediately found a printer-based hack in an npm package.
- hunterpayne 8mo agoI think I'm the last living engineer based on this conversation. Installers have worked this way for decades.
- Orygin 8mo agoNot for programming package managers. Npm is not some generic software package manager, it's for node. No other tool does this.
- zahlman 8mo agoCan't the unpacked code just detect the uninitialized state and complete the install on first run? (You know, after the developer has had a chance to audit the code, pass security scanners over it etc. before it runs?)
- zbentley 8mo agoYeah. Another big benefit of this approach is that it can use or trigger OS-level permissions approval prompts (eg UAC or MacOS’s “do you want to let this program access the desktop?” approvals).
- hunterpayne 8mo agoNo, the installer runs with privs the app won't.
- zbentley 8mo agoMany, many other programming languages’ package managers don’t (or can’t) do this, though. Even big complex desktop apps can, on first run, request initial setup permissions or postinstall actions via the OS’s permissions approval system. Genuine question as someone who uses it rarely: why is that need so much more common in NPM? Why are packages so routinely mutating systemwide arbitrary state at install time rather than runtime? Why is “fail at runtime and throw a window/prompt at the user telling them to set something up” not the usual workflow in NPM as it is in so many other places?