3 ms·
I know where you're coming from. I've been worried about all the supply chain attacks on npm too. And I'm far from a security expert. However, if you're okay wi
by bobajeff 2mo ago
I know where you're coming from. I've been worried about all the supply chain attacks on npm too. And I'm far from a security expert. However, if you're okay with installing binary packages via `curl somesite.com | sh` I don't think you are in a better position with regards to security.
- slowin 2mo agoSecurity is just one of my concerns. I'm actually more worried about borking my system because it's doing some out of band stuff with various javascript pieces that already exist on my system (not by my choice!).
- rbanffy 2mo agoI write command line tools primarily with Python and one thing I always try to do is to limit myself to the standard library, which, with Python, is quite sufficient for most of what I do. Anyway, most of what I write is designed to be installed in a virtualenv, which restricts the blast radius to one specific application.