3 ms·
That's one way to fix supply chain vulnerabilities.
by cozzyd 6mo ago
That's one way to fix supply chain vulnerabilities.
- tantalor 6mo agoCan't have any vulnerabilities if you don't have a supply chain
- nine_k 6mo agoMore seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run. Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm. (Same logic obviously applies to Python packages, Docker images, etc.)
- miohtama 6mo agoOnly if we had a turn key distributed cache, like IPFS
- cluckindan 6mo agoWaiting for the BitTorrent package manager
- ibejoeb 6mo agoDoes IPFS support content eviction now? If not, that could go wrong really fast. You get a compromised package out there and then, I think, literally every node needs to unpin it or it remains.
- zadikian 6mo agoPresumably, how ever you mark a version as latest would also be how you mark one as compromised. IPFS files are immutable and keyed by hash. But this seems like overengineering.
- XorNot 6mo agoCaching NPM was easier when you could pull the Couchbase replicate API. Afaik that's gone and now you just have to send a bazillion http requests instead.
- nine_k 6mo agoSending a bazillion http requests within your LAN, or at least your VPC, is much easier, faster, and cheaper. Both yarn and pnpm support http/2 which speeds up the bazillion requests quite a bit.
- hmokiguess 6mo agoAt my former job we had a private registry that was a mirror of npm’s with an approval gate for packages devs would request and it would always pin versions I took that for granted back then and just assumed it was standard enterprise policy
- jamesfinlayson 6mo agoMultiple previous jobs had this too (local Packagist is thing, Artifactory is another) but my current job got rid of theirs. Seemed a little short-sighted given the risks but I don't make the decisions.
- spartanatreyu 6mo ago> a local artifact storage for internal npm packages looks like a wise thing to have done long ago Deno already does this invisibly by default. All packages are stored in the global cache. No need to store multiple versions of the same dependencies across projects. To the code in your projects: there is no such thing as a global cache. Just import your dependencies like normal and deno maps them to the global cache.