Critical vulnerability of NPM package macaddress

Re:Critical vulnerability of NPM package macaddress by nucleardog on Monday June 11, 2018 @03:18PM (#17287560)

Somebody Google'd "get mac address from script linux" and scrolled through a couple things involving awk and other nonsense until they found something easily digestible--a StackOverflow answer saying:

    For particular interface like for eth0:
    cat /sys/class/net/eth0/address

Then without thought or understanding, put that into their JavaScript as directly as possible.

This is someone doing work without a full understanding of the problem space. Less of a programmer, more of a programming technologist. I don't find it surprising at all.

[ Parent | on HN ]

Re:Critical vulnerability of NPM package macaddress by arghwhat on Tuesday June 12, 2018 @04:09AM (#17291541)

Hmm, an adequate explanation, but why in the world is someone making a public library out of that, and furthermore, why in the world are people using this library? The library has been downloaded 2300 times in the past year!

I have nothing against bad developers—we all started there—but there is something seriously wrong with the JavaScript ecosystem and the barrier of entry for pushing your code into other people's projects through libraries.

[ Parent | on HN ]