News for hackers. Stuff that matters.

A comment on How to gain code execution on hundreds of millions of people and popular apps. Parent comment

Re:How to gain code execution on hundreds of millions of peo... by TheDong on Friday February 28, 2025 @08:59PM (#43214775)
You have to meet your users where they are. Your users are not using nix and bazel, they're using npm and typescript.

If your users are using bazel, it's easy to separate "download" from "build", but if you're meeting your users over here where cows aren't spherical, you can't take security that seriously.

Security doesn't help if all your users leave.

[ Parent | on HN ]
Re:How to gain code execution on hundreds of millions of peo... by jasonkester on Saturday March 01, 2025 @02:25AM (#43216835)
The simple solution would be to check your node-modules folder into source control. Then your build machine wouldn’t need to download anything from anywhere except your repository.
[ Parent | on HN ]