Devs unknowingly use “malicious” modules snuck into official Python repository

Re:Devs unknowingly use “malicious” modules snuck into offic... by chii on Monday September 18, 2017 @06:35AM (#15274686)

But the large number of packages available, even for seemingly trivial features, are what makes NPM popular and successful. You jest at left-pad, but there's real value in simple libraries they might only be "a few lines of code" because an app is made up of a large amount of "simple features" strung together.

Not to mention the code reuse factor.

If npm took the route of debian's verification/certification, you might end up with no libs at all!

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by dozzie on Monday September 18, 2017 @03:21PM (#15278704)

> You jest at left-pad, but there's real value in simple libraries they might only be "a few lines of code"

Nicely said, but you omit the elephant in the room: that the dependencies have their cost, which is quite high and is rarely matched, much less offset, by the value of these "simple libraries".

[ Parent | on HN ]