Detecting the use of “curl | bash” server side

Re:Detecting the use of “curl | bash” server side by raverbashing on Tuesday December 27, 2022 @05:36PM (#34154806)

> if it got moved into the std lib, it was probably useful enough

Of course it was useful, hence why most non-crappy languages had it in its stdlib from inception pretty much

But building a package just to do left-pad is stupid, especially since it can be implemented in a couple of lines

[ Parent | on HN ]

Re:Detecting the use of “curl | bash” server side by SpeedilyDamage on Tuesday December 27, 2022 @05:40PM (#34154831)

You can’t both believe it’s worth putting in the stdlib and not worth importing a library for, if your intention is to be consistent.

[ Parent | on HN ]

Re:Detecting the use of “curl | bash” server side by Too on Wednesday December 28, 2022 @04:03AM (#34159019)

You are neglecting the risk-factor of pulling in libraries from unknown authors on npm vs the stdlib. The package-bloat problem is one of culture, where developers keep neglecting this risk, only seeing the 5 lines of code they save by importing something, without seeing the potential cost and tech debt of having to review, maintain, update and security-monitor this dependency for all future.

Nobody thinks leftPad was not a useful function. The question is, was it useful enough to counter all the risks of npm, probably not. In the stdlib there is no such risk.

[ Parent | on HN ]

Re:Detecting the use of “curl | bash” server side by SpeedilyDamage on Wednesday December 28, 2022 @08:19AM (#34160668)

Ah, and now we’re talking about the real issue, which was the security risk.

My point has been this whole time that left-pad was not a story of a trivial function needlessly pulled from an external source as the person I replied to had claimed, and it appears you agree. Good!

[ Parent | on HN ]