News for hackers. Stuff that matters.

A comment on Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps. Parent comment

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by throw_m239339 on Sunday January 09, 2022 @08:28PM (#29869474)
> The software industry doesn't have any standards about how to publish or consume software, and that leads to problems like these (not the conflict over OSS, but the ability for random upstream software to randomly compromise thousands of other projects).

The publishing side is irrelevant. Anybody can make any package available for free on the internet. The unwillingness of some private businesses, often billion dollar companies, to audit and vet libraries because obviously, it costs money and these businesses use open source as a way to cut cost at first place, is the issue. The entitlement.

[ Parent | on HN ]
Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by 0xbadcafebee on Sunday January 09, 2022 @09:21PM (#29869850)
Why do you think we have zoning codes for how to build buildings? It's not solely because people refused to pay for buildings to be built the right way. Building things the right way takes longer and is more difficult, so people just didn't do it until they were forced to. The money is a red herring.

Businesses don't really use open source to cut costs. Most businesses don't even know they're using open source. The business hires engineers and tells them what they want built, and the engineers choose to use open source, because they're lazy and it's quicker than trying to get proprietary vendors approved and licensing costs included in budget forecasts. Maybe some tiny companies that have no money really need to use FOSS, but the majority of businesses pay for software when they need to, they don't mind.

[ Parent | on HN ]