Devs unknowingly use “malicious” modules snuck into official Python repository

Re:Devs unknowingly use “malicious” modules snuck into offic... by seanp2k2 on Monday September 18, 2017 @04:14AM (#15274159)

The culture around what should be in a package is vastly different. Node has left-pad. Debian has stuff like Apache. Sure, those are radical examples, but the barrier to entry for Debian is pretty high (as is the standard for quality) vs npm where anyone can put whatever out there.

How do things like left-pad even come to be widespread dependencies? Does the node development process involve a lot of "gee I wonder if someone made a package for (simple thing I need to do with a few lines of code)"?

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by ubernostrum on Monday September 18, 2017 @06:19AM (#15274624)

JavaScript has things like left-pad because it doesn't have a standard library of modules for common tasks like other languages do, and because some of its built-in types don't have the same rich set of operations as other languages.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by Babooster on Monday September 18, 2017 @09:10AM (#15275499)

http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how...

is a nice article on the subject of left-pad. If you can't implement a left-pad in less than 5 minutes yourself, you don't know how to code.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by Ajedi32 on Monday September 18, 2017 @09:34AM (#15275750)

Just because you _can_ spend 5 minutes re-inventing the wheel in every project you write, doesn't mean you _should_.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by chii on Monday September 18, 2017 @06:35AM (#15274686)

But the large number of packages available, even for seemingly trivial features, are what makes NPM popular and successful. You jest at left-pad, but there's real value in simple libraries they might only be "a few lines of code" because an app is made up of a large amount of "simple features" strung together.

Not to mention the code reuse factor.

If npm took the route of debian's verification/certification, you might end up with no libs at all!

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by dozzie on Monday September 18, 2017 @03:21PM (#15278704)

> You jest at left-pad, but there's real value in simple libraries they might only be "a few lines of code"

Nicely said, but you omit the elephant in the room: that the dependencies have their cost, which is quite high and is rarely matched, much less offset, by the value of these "simple libraries".

[ Parent | on HN ]