4 ms·
A quick word of warning for anyone following this guide. You should never sudo npm install. That's giving root privileges to anyone that care's to upload code t
by Wintamute 13y ago
A quick word of warning for anyone following this guide. You should never sudo npm install. That's giving root privileges to anyone that care's to upload code to the npm package registry. npm should work fine without sudo.
- sneak 13y agoFurthermore, it doesn't appear that any of these fad language repositories do any sort of package signing, so you're vulnerable not just to the people who upload their own code, but anyone who may compromise the mirrors, too, because even if you trust the source, there's no way of verifying the code hasn't been modified on the mirror. See also: http://cristianobetta.com/blog/2013/02/02/ruby-gems-are-not-safe-to-use/ http://cristianobetta.com/blog/2013/02/02/ruby-gems-are-not-...
- sgrove 13y agoI believe Clojars at least supports package signing, if not requires it. Was extremely useful in a code audit recently.
- SanderMak 13y agoAnd even the established ones which do require signing are not really trivial to use correctly: http://branchandbound.net/blog/security/2012/08/verify-dependencies-using-pgp/ http://branchandbound.net/blog/security/2012/08/verify-depen...
- contrahax 13y ago> fad language lol
- vixen99 13y agoNo doubt I've nothing better to do but stare aghast at "care's to upload code". It's a matter of deep mystery to me that folk adept at using languages demanding absolute grammatical precision treat their native language so carelessly.
- mistermumble 13y agoTwo assumptions you're making: 1) That English is the poster's native language 2) the poster did not use auto-correct
- Wintamute 13y agoHah. I just reread my comment and stared aghast at my own error. Languages requiring absolute grammatical precision fail to compile with errors, not so Hacker News comments sadly. There, I just solved your mystery for you :)