5 ms·
What can be done to help sort problems like this?
by codefined 9y ago
What can be done to help sort problems like this?
- eropple 9y agoTo be honest? I don't know. Bugs (or malicious end-runs) are only shallow with many eyes, and none of this has eyes on it.
- tedunangst 9y agoGardens. With gardeners. And walls.
- i_am_nomad 9y agoAnd money for all three.
- deleted 9y ago[deleted]
- tedunangst 9y agonpm has about $10 million, so that shouldn't be a problem.
- kimburgess 9y agoIntegrating something like https://nodesecurity.io/opensource https://nodesecurity.io/opensource or https://snyk.io https://snyk.io into you're CI process will help flag issues you may want to know about if they are disclosed / discovered. And yes, I get the irony of adding another dependency to help with the security mess caused by the node ecosystem's bent towards external untrusted / unverified dependencies.
- Splines 9y agoNot a js dev, but it seems like when doing a compare if a package already exists, hyphens should be removed (so "crossenv" and "cross-env" are considered identical). "js" seems like needless verbosity, maybe take that out too. I wouldn't doubt that there are package names that would collide because of such a change, but that's probably a good thing. Does npm normalize package names with unicode in them? Would "сrοѕѕ-еnν" be considered equivalent? (Although this would only work if users copy/paste the name).