What NPM should do to stop a new colors attack

Re:What NPM should do to stop a new colors attack by paulhodge on Monday January 10, 2022 @06:29PM (#29884615)

On the other side of the spectrum, if no one was installing 'latest', then no one would be testing latest, and we wouldn't catch these bugs until later. We would just all get surprised after 2 weeks (or whatever arbitrary delay) until the bad version became the blessed default version.

In other words.. If there isn't a trusted test pipeline then there's no benefit in delaying the latest version. Might as well just get latest.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by jessaustin on Monday January 10, 2022 @08:55PM (#29886192)

In other contexts, the best ways to deal with trade-offs use randomness. Perhaps this sort of stunt would cause less damage if npm just randomly chose which versions to use. To avoid churn, the random choices could be stored in lockfiles. The point would be that not everyone is using the newest version of any particular package.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by symlinkk on Monday January 10, 2022 @11:45PM (#29887672)

People starting from scratch would get latest, whereas people maintaining existing projects would be able to upgrade when they feel it’s safe to to so. Do you really want the people maintaining the nuclear reactor code being testers for latest?

[ Parent | on HN ]