News for hackers. Stuff that matters.
Re:Malicious code in the purescript NPM installer by soulofmischief on Sunday July 28, 2019 @10:00PM (#20550944)
But it doesn't work for libraries people will be using in development. Often you are waiting for a handful of packages to introduce specific features or bug fixes and need them the moment they are available. NPM isn't user space, it's dev space. Timeliness is the maxim.
Re:Malicious code in the purescript NPM installer by umanwizard on Sunday July 28, 2019 @10:06PM (#20550969)
I’m not a JS developer so maybe I’m missing something, but how do you use a library during development and not use it in production?

In the C++ world, I can’t imagine a situation where you would need to depend on, for example, libjpg while developing, but not need to read JPEG files in prod/end-user-space.

Re:Malicious code in the purescript NPM installer by huehehue on Monday July 29, 2019 @12:52AM (#20551607)
There are a slew of dev-only dependencies in JS-land. Packages that run local servers for hot-reloading during development. Test runners, linters, TypeScript compilers, SCSS compilers, and so on. None of those things need to be included with the bundled product.

Check out Electron or React starter apps for an example, their boilerplates should have dozens of examples.

Re:Malicious code in the purescript NPM installer by soulofmischief on Monday July 29, 2019 @01:01AM (#20551642)
Since another user explained that point, I would also add that in the "move fast and break things" environment of the web, for better or for worse, responsive and automated library updates are often desirable or even required functionality which can be tied to substantial real-world profits if something suddenly goes wrong somewhere in the stack.
Re:Malicious code in the purescript NPM installer by pjmlp on Monday July 29, 2019 @02:31AM (#20551973)
Web development is one of my tasks and thakfully we don't move fast and break things, rather rely on proven and established development stacks like JEE, Spring, ASP.NET and VanilaJS.
Re:Malicious code in the purescript NPM installer by soulofmischief on Monday July 29, 2019 @02:54AM (#20552078)
There are some reasonably stable packages in the npm ecosystem, it's just pretty much the Wild West out there. It really depends on what you're building. It's pretty hard to get a new SPA started these days without a development environment which uses npm, especially if you're running lean.

The problem is keeping your dependency tree reasonable. Even pulling in a couple of packages might lead to hundreds of dependencies. And even if you have the sense not to use an external package for something as simple as left-padding a string, someone somewhere in that dependency tree might not feel the same way. And that's all it takes to bring a chunk of the web down.

All of these problems of course are due to JS not having a mature ecosystem or standard library. People shouldn't need to reinvent the wheel every hour, nor should they be pulling in modules less than a dozen or two lines of code. That, and the constant misguided financial incentive to deploy ever more complex functionality over http are what lead to this aggressive push for cutting edge tools.

Re:Malicious code in the purescript NPM installer by naniwaduni on Sunday July 28, 2019 @10:29PM (#20551075)
In the C++ world, you almost certainly don't need headers in prod.
Re:Malicious code in the purescript NPM installer by umanwizard on Sunday July 28, 2019 @10:31PM (#20551084)
Yes, true. What’s your point? You still need libjpg to be either statically linked into your executable or present on the target system.
Re:Malicious code in the purescript NPM installer by liveoneggs on Monday July 29, 2019 @03:43PM (#20558582)
headers are not libraries