2 ms·

> NPM is by no means the worst offender here Ok, I can agree it is a boring comment, but who is worse? NPM gets targeted both because it is popular and becaus

> NPM is by no means the worst offender here Ok, I can agree it is a boring comment, but who is worse? NPM gets targeted both because it is popular and because there is a wider attack surface (lots of little packages promoted by a huge variety of users) I have a high schooler who published work a couple weeks ago. This is good, but it comes with downsides. Maybe a couple more speed bumps or classifiers would be helpful. Maybe a consolidation of under maintained projects and deprecation is in order.

insanitybit 3mo ago
Arguably crates.io is worse. NPM has cooldowns and has for a while, it has had Trusted Publishing for longer, it has human-approved releases that separate CI/CD from actual publishing. Ruby is probably worse in every way.
- woodruffw 3mo ago
  RubyGems actually adopted Trusted Publishing before both npm and crates.io. To my recollection, they were second after PyPI. (I have no opinion about the overall security posture of these indices.)
  - insanitybit 3mo ago
    No build script control though.
    - woodruffw 3mo ago
      Yep. That remains the norm with Python source distributions as well. It’s a hard thing to overcome when it’s baked deeply into packaging assumptions.
      - insanitybit 3mo ago
        Yeah, my point is just that other package managers aren't in a great spot. NPM even lets you separate out "publish" and "release" now where you can publish to the registry but you have to separately "ack" that to release. That's kinda a huge win if people use it. I just think the framing that npm is so bad is really flatly invalid.
        altcognito 3mo ago
        > the framing that npm is so bad is really flatly invalid. Is it really though if we're getting thousands of compromised packages regularly? You can do all the right things and still be legit problematic.
        insanitybit 3mo ago
        Yes, it has nothing to do with the design of npm (relative to similar languages/ repositories) and everything to do with the popularity.
        woodruffw 3mo ago
        I don’t think npm itself is measurably bad in ways that are useful to index on. Like others, I think that JS as an ecosystem has a culture that encourages both dependency sprawl and living at the edge, both of which contribute to the end problem of OSS malware. (Rust has a similar culture, to be clear. I don’t think it’s a death knell.)

insanitybit 3mo ago

Arguably crates.io is worse. NPM has cooldowns and has for a while, it has had Trusted Publishing for longer, it has human-approved releases that separate CI/CD from actual publishing. Ruby is probably worse in every way.

woodruffw 3mo ago
RubyGems actually adopted Trusted Publishing before both npm and crates.io. To my recollection, they were second after PyPI. (I have no opinion about the overall security posture of these indices.)
- insanitybit 3mo ago
  No build script control though.
  - woodruffw 3mo ago
    Yep. That remains the norm with Python source distributions as well. It’s a hard thing to overcome when it’s baked deeply into packaging assumptions.
    - insanitybit 3mo ago
      Yeah, my point is just that other package managers aren't in a great spot. NPM even lets you separate out "publish" and "release" now where you can publish to the registry but you have to separately "ack" that to release. That's kinda a huge win if people use it. I just think the framing that npm is so bad is really flatly invalid.
      - altcognito 3mo ago
        > the framing that npm is so bad is really flatly invalid. Is it really though if we're getting thousands of compromised packages regularly? You can do all the right things and still be legit problematic.
        insanitybit 3mo ago
        Yes, it has nothing to do with the design of npm (relative to similar languages/ repositories) and everything to do with the popularity.
      - woodruffw 3mo ago
        I don’t think npm itself is measurably bad in ways that are useful to index on. Like others, I think that JS as an ecosystem has a culture that encourages both dependency sprawl and living at the edge, both of which contribute to the end problem of OSS malware. (Rust has a similar culture, to be clear. I don’t think it’s a death knell.)