Re:Detecting the use of “curl | bash” server side
by raverbashing on Tuesday December 27, 2022 @05:36PM
(#34154806)
> if it got moved into the std lib, it was probably useful enough
Of course it was useful, hence why most non-crappy languages had it in its stdlib from inception pretty much
But building a package just to do left-pad is stupid, especially since it can be implemented in a couple of lines
Re:Detecting the use of “curl | bash” server side
by SpeedilyDamage on Tuesday December 27, 2022 @05:40PM
(#34154831)
You can’t both believe it’s worth putting in the stdlib and not worth importing a library for, if your intention is to be consistent.
Re:Detecting the use of “curl | bash” server side
by Too on Wednesday December 28, 2022 @04:03AM
(#34159019)
You are neglecting the risk-factor of pulling in libraries from unknown authors on npm vs the stdlib. The package-bloat problem is one of culture, where developers keep neglecting this risk, only seeing the 5 lines of code they save by importing something, without seeing the potential cost and tech debt of having to review, maintain, update and security-monitor this dependency for all future.
Nobody thinks leftPad was not a useful function. The question is, was it useful enough to counter all the risks of npm, probably not. In the stdlib there is no such risk.
Re:Detecting the use of “curl | bash” server side
by SpeedilyDamage on Wednesday December 28, 2022 @08:19AM
(#34160668)
Ah, and now we’re talking about the real issue, which was the security risk.
My point has been this whole time that left-pad was not a story of a trivial function needlessly pulled from an external source as the person I replied to had claimed, and it appears you agree. Good!
> It is highly probable that the majority of current string padding implementations are inefficient. Bringing this into the platform will improve performance of the web, and developer productivity as they no longer have to implement these common functions.
“It’s too trivial” is not why left-pad was in the news. Go read about it to understand the actual issue: https://www.theregister.com/AMP/2017/07/12/javascript_spec_s...