Re:Malicious code in the purescript NPM installer
by munificent on Monday July 29, 2019 @01:33PM
(#20557122)
> is easily fixed in a semi-automated, supervised way.
It's not. Once you have shared, transitive dependencies, the application author consuming a package is no longer the one who authored or is in control of the dependency on that transferred package.
> A very large transitive dependency graph is a terrible thing to have.
This is a fair subjective preference. Unfortunately, it flies in the face of reality. Anyone who maintains a package manager will tell you real-world package graphs are typically quite large and deep. If users didn't want that, they wouldn't do it.
> Your package manager should scold you for it!
Users don't generally like or use tools that scold them for doing what they want to do.
If ownership changes, I want to know. It's perfectly fine to cause a little bit of breakage there that is easily fixed in a semi-automated, supervised way.
If a name changes, there could just be an alias, unless there's literally a trademark dispute underway, in which case the ownership-change process can be applied.
> When you have very large transitive dependency graphs, the result is constant, pointless churn.
A very large transitive dependency graph is a terrible thing to have. It shouldn't be made convenient to have it. Your package manager should scold you for it!
In all seriousness, if you have such a huge graph, then the amount of churn caused by package updates will likely be the dominating factor, not the change of ownership.