Re:Netmask NPM package, used by 270k+ projects, vulnerable t...
by golergka on Monday March 29, 2021 @09:36AM
(#26621321)
Depends on the library in question. I don't think that lodash doesn't get enough eyeballs on it.
[ Parent
| on HN ]
Re:Netmask NPM package, used by 270k+ projects, vulnerable t...
by mikepurvis on Monday March 29, 2021 @09:54AM
(#26621573)
Well yes, but the point is that everything in the stdlib receives scrutiny and a long-term commitment to mainenance/upkeep. A small proportion of pypi/npm receives these things, but the vast majority is abandonware trash. You only have to briefly scroll through the main PyPI index to realise just how awful it is:
https://pypi.org/simple/ (caution— multi-megabyte html)
Re:Netmask NPM package, used by 270k+ projects, vulnerable t...
by oblio on Monday March 29, 2021 @09:53AM
(#26621555)
Lodash might, or might not, offer the same guarantees that a stdlib generally offers: backwards and forwards compatibility, a clear deprecation and removal schedule, etc.
It's great to have high quality third party libraries but stuff like most of lodash should be in a stdlib, already.
Re:Netmask NPM package, used by 270k+ projects, vulnerable t...
by dmos62 on Monday March 29, 2021 @09:51AM
(#26621517)
You have a point there, but if you have a very well vetted third-party library that provides things as basic as IP address parsing, you'll probably see that library included into the official library package.