Re:Bun: Fast JavaScript runtime, transpiler, and NPM client ...
by TimTheTinker on Tuesday July 05, 2022 @05:29PM
(#31993970)
True, the only real counterpoint is someone who clones the repo, inspects it, and builds from source.
[ Parent
| on HN ]
Re:Bun: Fast JavaScript runtime, transpiler, and NPM client ...
by phist_mcgee on Tuesday July 05, 2022 @07:29PM
(#31995012)
Do you really own your own operating system if you haven't compiled the kernel yourself?
Re:Bun: Fast JavaScript runtime, transpiler, and NPM client ...
by TimTheTinker on Tuesday July 05, 2022 @08:29PM
(#31995422)
Even if you do compile the kernel yourself, do you really own your OS if you haven't compiled the compiler yourself? Did you use a pre-built compiler binary to compile the compiler?
Now we're getting to the real questions in life. :)
(Incidentally, this is probably the most fundamental software supply chain attack vector - manipulate the compiler binary used to compile the compiler used to compile the kernel and userspace. The attack payload would never appear in any sources, but would always be present in binaries.)
Re:Bun: Fast JavaScript runtime, transpiler, and NPM client ...
by phist_mcgee on Saturday July 09, 2022 @04:37AM
(#32033133)
A little late but an obligatory read:
https://www.quora.com/What-is-a-coders-worst-nightmare/answe...