Malicious code in the purescript NPM installer

Re:Malicious code in the purescript NPM installer by twic on Monday July 29, 2019 @05:25AM (#20552807)

> a large number of skilled people

> RubyGems

Well, which is it?

Java has used namespaced packages since 1996, and it's been a roaring success. There have certainly been problems - for example, there is currently some absolute nonsense going on about the handover of big chunk of stuff from Oracle to the Eclipse Foundation [1] - but they have always been manageable, and don't come close to outweighing the benefits.

[1] https://www.infoq.com/news/2019/05/end-of-javax-package/

[ Parent | on HN ]

Re:Malicious code in the purescript NPM installer by littlestymaar on Monday July 29, 2019 @05:58AM (#20552979)

Java was indeed a success, but its dependency management is archaic at best. Yes it's better than FORTRAN or C, but I wouldn't use it as a reference in 2019…

[ Parent | on HN ]

Re:Malicious code in the purescript NPM installer by LoSboccacc on Monday July 29, 2019 @07:42AM (#20553464)

it's signed, hierarchical, decentralized, supports addressing multiple artifacts within the same module by type, includes a standardized way to retrieve sources or docs, supports pinning the version of transitive dependencies so you can manually resolve conflicts and on top of that can be extended to use completely alien package sources (which is unholy if you ask me, but it helped me survive the great osgi catastrophe of the 2010s thanks to tycho)

[ Parent | on HN ]

Re:Malicious code in the purescript NPM installer by kkapelon on Monday July 29, 2019 @06:34AM (#20553122)

what would you use instead as a reference?

[ Parent | on HN ]