News for hackers. Stuff that matters.

A comment on Node.js packages don't deserve trust. Parent comment

Re:Node.js packages don't deserve trust by majidazimi on Monday April 11, 2022 @10:28AM (#30989221)
Simply because blast radius for Java is limited to a set of very high quality libraries -- in terms of code not functionality. These libraries come from Apache Foundation, Eclipse Foundation, Google, Facebook, Spring, etc. Literally every single Java application depends on something from Apache [ok I understand stuff like Log4Shell can still happen].

The same is not true for JS. The most mature libraries depend on absurdly vague libraries that no one has ever reviewed.

[ Parent | on HN ]
Re:Node.js packages don't deserve trust by ragnese on Monday April 11, 2022 @11:08AM (#30989842)
I was going to ask the obvious question of why the Java ecosystem ended up differently than the JavaScript ecosystem, but I think I know the answer.

It's a giant pain in the ass to publish a Java library. That's already weeding out a ton of low-effort projects. By itself, I wouldn't exactly call that a good thing, but it seems to have a silver lining...

[ Parent | on HN ]