Re:Malicious code in the purescript NPM installer
by TeMPOraL on Sunday July 28, 2019 @10:03PM
(#20550957)
People care about having more packages much more than abstract fears of security or quality of those packages.
At their own peril.
Re:Malicious code in the purescript NPM installer
by justinclift on Monday July 29, 2019 @01:10AM
(#20551672)
> People care about having more packages much more than abstract fears of security or quality of those packages.
You're partially right. Some people haven't yet learned (eg the hard way, or whatever) that quality does matter.
Hopefully most of those people will learn to appreciate and demand quality over time, instead of the current anything-goes-approach.
In the meantime, things like this npm package example will continue to give npm/javascript black eyes (repeatedly) and help make that happen. :)
Re:Malicious code in the purescript NPM installer
by umanwizard on Sunday July 28, 2019 @09:52PM
(#20550914)
> modern
Apt is about 20 years old, and the most famous apt package repos (I.e., the Ubuntu project) is much younger than that.
All other "modern" (where "modern" is "last 20 years") package managers have zero curation.
Perl, Python, Ruby, Go, Rust, Dart, JavaScript.
You say: "if they had curation, they would be better".
I say: "if they had curation, they would have lost to a competitor that doesn't have curation".
People care about having more packages much more than abstract fears of security or quality of those packages.