Node.js Compiler – Compiling your Node.js application into a single executable

Re:Node.js Compiler – Compiling your Node.js application int... by int_19h on Friday May 05, 2017 @03:48PM (#14276293)

There are evident security issues with this, as spelled out in the bug. Yeah, I'd consider that broken. Of course the repro is contrived, but it's not at all unusual to install some packages manually. The point is that once you do so, you might not get the same result later from package.json, either.

And yes, Yarn is the sane option for package management for Node. Why isn't it the default one yet?

[ Parent | on HN ]

Re:Node.js Compiler – Compiling your Node.js application int... by Can_Not on Friday May 05, 2017 @08:42PM (#14277962)

> but it's not at all unusual to install some packages manually

If you're taking about deployments, that's definitely unusual. Outside of deployments, what's a scenario where deterministic builds are important, but it would be considered normal to manually install them anyways?

[ Parent | on HN ]

Re:Node.js Compiler – Compiling your Node.js application int... by int_19h on Saturday May 06, 2017 @03:51AM (#14279216)

I don't see why deterministic builds would only be important for deployments. Even ignoring the security issues here (which don't necessarily apply only to deployments), there's this whole classic "works for me, not a bug" situation.

[ Parent | on HN ]

Re:Node.js Compiler – Compiling your Node.js application int... by Can_Not on Saturday May 06, 2017 @04:47PM (#14282173)

> I don't see why deterministic builds would only be important for deployments.

Great, then you should be able to mention at least one solid normal usecase as an example. I don't think there is one.

[ Parent | on HN ]