Re:I've Just Liberated My Modules
by brazzledazzle on Wednesday March 23, 2016 @03:16AM
(#11342658)
I'm curious since it strikes me as a hard problem to solve: How do you resolve having to deal with security issues with tens or hundreds of dependencies (and their dependencies)? How do you even know whether they have a security issue or a version bump is just a bug fix without digging into each one on a regular basis?
[ Parent
| on HN ]
Re:I've Just Liberated My Modules
by acjohnson55 on Wednesday March 23, 2016 @11:48AM
(#11345501)
How do you know that you, as a lone developer, aren't writing insecure, unperformant, buggy code?
Re:I've Just Liberated My Modules
by brazzledazzle on Wednesday March 23, 2016 @01:55PM
(#11346695)
That's a fair point. But what would concern me, as a lone developer, is liability if you get hacked due to a known vulnerability in an npm module. If the company is looking for a head to roll and someone points out it was a known and resolved issue in later versions that could be a problem for me.
Does npm let you tag releases as security fixes? That would make automation to discover it possible.
Re:I've Just Liberated My Modules
by acjohnson55 on Wednesday March 23, 2016 @11:21PM
(#11350349)
NPM itself is clearly faulty, but I don't think the concept of outsourcing logic to dependencies is. If something is complex enough to have a legit security vulnerability, it's probably the sort of thing I don't really want to write myself. And yeah, that comes with the responsibility to stay up-to-date. But pretty sure my head would rightfully roll anyway if I wrote my own bootleg SSH protocol and got my company exploited.