News for hackers. Stuff that matters.

A comment on Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign. Parent comment

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by latexr on Friday April 24, 2026 @02:04PM (#47893750)
I’m not the person you asked, but given the choice I avoid a language without JSON parsing officially supported because I need that frequently. It’s the reason I never picked up Lua, despite being interested in it.
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by pdimitar on Friday April 24, 2026 @02:06PM (#47893786)
Interesting, thanks for sharing your anecdote. Upvoted.

I am openly admitting I don't care. Such libraries are in a huge demand and every programming language ecosystem gains them quite early. So to me the risk of malicious code in them is negligibly small.

[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by latexr on Friday April 24, 2026 @03:34PM (#47894787)
To me it’s not just the risk of malicious code, but also convenience. For example, if I’m using a scripted language and sharing it in some form with users, I don’t want to have to worry about keeping the library updated, and fight with the package manager, and ship extraneous files, and…
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by pdimitar on Friday April 24, 2026 @03:39PM (#47894850)
Ah, I don't work with scripting languages though. I understand the difference in usages. Your use-case is quite valid.
[ Parent | on HN ]