4 ms·
The lack of a comprehensive standard library for JavaScript also results in projects pulling many more third party dependencies than you would with most other m
by nirvdrum 5mo ago
The lack of a comprehensive standard library for JavaScript also results in projects pulling many more third party dependencies than you would with most other modern environments. It’s just a bigger attack surface. And if you can compromise a module used for basic functionality that you’d get out of the box elsewhere, the blast radius will be enormous.
- pico303 5mo agoNot to mention a culture of basically one-line packages ad infinitum. I downloaded a JS tool the other day to generate test reports and it had around 300 dependencies. Needless to say I’m running all my JS tools in a Docker container these days.
- wombatpm 5mo agoSo why hasn’t someone created a batteries include JS library? I don’t program in JS on the backend so I don’t know how feasible something like that is.
- girvo 5mo agoEveryone’s ideas of what batteries should be included differ
- stevekemp 5mo agohttps://github.com/stdlib-js/stdlib https://github.com/stdlib-js/stdlib was is one of several attempts at that, but yes the issue is that different people have very different views of what should be standard.
- fc417fc802 5mo agoThat doesn't seem like it should be an issue in practice? Rather than a single standard library endorsed by the language stewards if the community at large converges on a small handful of "standard" solutions that seems like it would satisfy the security aspect of things.
- erikerikson 5mo agoLodash but also, which batteries?