trickstra

38 ms·

421.
by trickstra 8y ago
> considering the majority of phones are androids. This is one of the ways they are trying to change that.
422.
by trickstra 8y ago
> Developers don't trust code, they trust people well the code doesn't write itself, so partially true. But ultimately it's about accountability. If Dominic himself added the backdoor, his presence in the community would e
423.
by trickstra 8y ago
> It is just as likely that the original author will turn malicious it absolutely isn't. The original author is a real person, with a twitter account, with a profile photo, with videos of talking at conferences. I accepted the code
424.
by trickstra 8y ago
losing the "momentum" on an abandoned package is a much better choice than having it fall into the wrong hands together with all the people who use it and didn't even know about the change of owner.
425.
by trickstra 8y ago
do you know how many of your paid software contains a similar disclaimer that removes their responsibility for the damages caused by the software? Only you'd never have a chance to look at that code and find this injection...
426.
by trickstra 8y ago
the mindset where handing over a package with 2 million weekly downloads to a complete stranger is a totally OK thing to do IS npm specific.
427.
by trickstra 8y ago
- the pervasiveness of left-pad style packages - npm's governance - the community's perspective and culture Also the low-effort nature of javascript language itself - no strong typing, able to rip out or replace foreign methods, e
428.
by trickstra 8y ago
well then lots of people in the Node ecosystem are wrong. If many people stopped hashing passwords, would you say that's a good thing to follow?
429.
by trickstra 8y ago
the overwhelming majority of people are not thieves either, but we still lock our cars when we leave them in the parking lot
430.
by trickstra 8y ago
Actually, it's not as hard as you make it sound: 1. - don't transfer - mark your repo Abandoned, tell people to use that other person's fork if you have to 2. - does that person have any other online presence? Long running? 3
431.
by trickstra 8y ago
that assumes you know that the maintainer changed
432.
by trickstra 8y ago
exactly, transferring a package to an unknown person is not only giving them access to the code but also to all the people who already trust that code