alt Hacker NewsOh, so it's not only "JavaScript bad and npm bad". Apparently, if your language uses third party dependency registry, you are prone to malicious code, regardless if it's Javascript or not.
Use containers for development. And reduce the amount of third party deps you import into your projects. This is only going to get worse.
Replies
If it weren't a registry it would be ./configure scripts and makefiles. The issue is that sandboxing technology is kinda shit (especially x-plat) and languages don't build it in by default.
npm is mentioned 5x on this page.
Just wondering, whenever things go wrong with Rust - why do you all (Rust devs) point the finger at JavaScript?
It’s the weirdest form of projection. More than 1 person is doing it here. It’s like the second Rust hits a failure mode you immediately go “well JavaScript is worse!”
Like that has anything to do with your failure (even if it was true)
Edit: 7 times and counting
Pulling in lots of dependencies creates this kind of risk regardless of the ecosystem. That being said in the JS/NPM world you tend to have a LOT more dependencies (especially indirect ones) than other languages. I saw someone do a cursory analysis and JS/Node projects tend to have 5x the number rust or ruby projects.
This is really a cultural problem not a technical one.