News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by chaostheory on Monday January 10, 2022 @09:25PM (#29886511)
"we are slowly (far too slowly) learning that our assumptions that all developers are benevolent is incorrect, and it's going to take another 2-5 instances of this kind of attack before people really start to understand why and see the danger of simply using libraries at all"

I agree, but at the same time if we had this mindset earlier; open source probably wouldn't have caught on as quickly. Maybe it wouldn't have become mainstream?

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by seoaeu on Tuesday January 11, 2022 @12:29AM (#29887946)
Honestly, it is kind of surprising we've gotten this far assuming that basically all open source maintainers aren't malicious
[ Parent | on HN ]