Re:Malicious code in the purescript NPM installer
by gridlockd on Monday July 29, 2019 @09:36AM
(#20554427)
I think the problem is that Java people are considered "old and lame", whereas the Javascript people are considered "young and immature", respectively. While this assessment is somewhat accurate, it inhibits the process of learning from each other.
Re:Malicious code in the purescript NPM installer
by allover on Monday July 29, 2019 @04:10PM
(#20558825)
> While this assessment is somewhat accurate
No it isn't, and please stop perpetuating this nonsense.
Re:Malicious code in the purescript NPM installer
by _pmf_ on Monday July 29, 2019 @07:14AM
(#20553298)
On further reading, it's debatable whether the "maliciousness" is not the community attempting to take away a project from its founder. Similar to how that toxic Twisted dev tried to push responsibility for maintaining their broken branch of Python 2 to the Python core lib dev.
You can fork, but then you're responsible for more than the "fun parts". The project founder might introduce measures to prevent fragmentation due to your bad decisions as part of damage control.
The Maven ecosystem has been doing things better than NPM for at least 10 years. The onus is on the NPM team for justifying their pathologically bad solution, it's also on the JS community to back off their "everybody can contribute" pipe dream. Maven works because in practice, we have some few organizations contributing packages, not thousands of individual, anonymous developers.