> what happens when popular-library.io goes down or gets hacked?
What is anyone going to do about it? Anything has a chance of getting hacked or goes down just when you need it, be it GitHub, npmjs.org...
Blaming the tool for not having a protection against DNS poisoning is a bit far fetched.
ultimately i guess it is about how/if deno caches its imports. with node.js/npm you have the exact same problems, just the source & sink occur at different places (package installation)
With Node.js you install the packages in a dev environment, and test extensively, then push all the code, including node_packages folder to production. Running npm on the prod server is forbidden. At least in theory =)
You can always download the scripts and host them yourself, right?
Re:Deno 1.0
by TechBro8615 on Thursday May 14, 2020 @01:57PM
(#23182999)
Do you also share these concerns about golang? Isn’t it basically the same system?
Golang does have https://proxy.golang.org/, which is fairly recent, but yes this is absolutely a problem in Go.
See the "go-bindata" problem.
Or how about attack vectors like DNS poisoning? or government-based firewalls?
I know there's this[1], but somehow I still feel uneasy because the web is so fragile and ephemeral...
At the very least I would like to have the standard library offline...
[1] https://github.com/denoland/deno/blob/master/docs/linking_to...