alt Hacker NewsYou can thank the npm and the like.
Before, people were responsible for the dependencies they were importing.
With npm and all the javascripters flooding the market, it became normal to be irresponsible "because everybody is doing it".
Fast-forward a couple of years, now everything is web based, even the stand-alone app version. No one knows what is running on own computer, even the Devs themselves don't know what the are asking you to run...
With a pinch of vibe coding on top, and thats the end.
We took 40 years for our industry to be taken seriously, it's all gone now.
Replies
There’s also been a regression in how infrastructure is operated.
15 years ago you didn’t let your production infrastructure talk out to the Internet, and if you did, it was via an explicit proxy with allowlisted domains. This significantly limited the damage that a malicious dependency could cause.
With the move to cloud and DevOps, that network security model disappeared.
> Before, people were responsible for the dependencies they were importing.
This is an attitude not reflective of reality for those that wrote code in the pre npm days
There's nothing new under the sun, as they say.
Perl had CPAN already in 1993; Linux and common BSD distros have basically always had package repositories.
"People were responsible for the dependencies they were importing" - I don't know about that. Plenty of us were irresponsible 30 years ago.
Don't know why you're getting scrutinized, npm didn't introduce malicious packages obviously but it did completely remove the feeling of suspicion and responsibility people had towards third party libraries.
The pre 2020 bootcampers would basically npm install anything because that's all they knew. You even had bullshit like "is-array" with millions of weekly installs because how dare you reinvent the wheel.
L take. Can’t blame npm for software shops wanting to run leaner and ship faster.
I’m personally glad I don’t have to download separate runtimes and apps and can just use the standard browser
Shared code repositories for OSS are much older than npm. See at least maven central for Java.
What makes npm a more relevant target is a much smaller standard library and thinner dependencies, leading to more chances that a random project will have code of suspicious provenance. The vast majority of what a backend Java project depends on was probably written either by the same 3 companies, or large, established OSS repos. So this is relatively solvable if people in steering committees decided they cared. It's improving, but I'd argue not fast enough.