Re:Malicious code in the purescript NPM installer
by munificent on Monday July 29, 2019 @01:33PM
(#20557122)
> is easily fixed in a semi-automated, supervised way.
It's not. Once you have shared, transitive dependencies, the application author consuming a package is no longer the one who authored or is in control of the dependency on that transferred package.
> A very large transitive dependency graph is a terrible thing to have.
This is a fair subjective preference. Unfortunately, it flies in the face of reality. Anyone who maintains a package manager will tell you real-world package graphs are typically quite large and deep. If users didn't want that, they wouldn't do it.
> Your package manager should scold you for it!
Users don't generally like or use tools that scold them for doing what they want to do.
It's not. Once you have shared, transitive dependencies, the application author consuming a package is no longer the one who authored or is in control of the dependency on that transferred package.
> A very large transitive dependency graph is a terrible thing to have.
This is a fair subjective preference. Unfortunately, it flies in the face of reality. Anyone who maintains a package manager will tell you real-world package graphs are typically quite large and deep. If users didn't want that, they wouldn't do it.
> Your package manager should scold you for it!
Users don't generally like or use tools that scold them for doing what they want to do.