SELinux is unmanageable; just turn it off if it gets in your way

Re:SELinux is unmanageable; just turn it off if it gets in y... by virtue3 on Wednesday April 27, 2022 @07:34AM (#31178643)

when it comes to JS libraries I'm usually a lot more interested in how good their testing is. Code quality can be very subjective in some areas. But if the dang library doesn't have a lot of good testing then I can't really trust any updates from it :/

[ Parent | on HN ]

Re:SELinux is unmanageable; just turn it off if it gets in y... by ryandrake on Wednesday April 27, 2022 @11:51AM (#31181556)

Coming from marine and aerospace contracting, I'm always shocked by the cavalier attitude The Rest Of The Software World has about pulling in third party dependencies. "I have a problem to solve. Let's Google for: [problem] [language]. Aha! This library on GitHub has 12 bajillion stars! Pull that one down, build it, and YOLO!" No in-depth look into what other things the dependency does, how it increases the attack surface, what user data it gobbles up, what license it uses, what is the update cadence and how often do we need to pull from upstream, what is the contingency plan if it ends up not being suitable, nothing. Just git push and close that JIRA ticket!

[ Parent | on HN ]

Re:SELinux is unmanageable; just turn it off if it gets in y... by gorjusborg on Wednesday April 27, 2022 @08:47AM (#31179189)

Inadvertant bugs are the last thing I worry about in the javascript (node) ecosystem.

I'm more concerned with the fact that running anything requires transitive trust to hundreds or thousands of projects in node_modules, any of which can run scripts while being installed.

How many people out of a thousand would you trust running commands at your terminal?

[ Parent | on HN ]