7 ms·
But that is the kind of convenience and ease of use that brings us another npm malware incident every other month at this point.
by kataklasm 10mo ago
But that is the kind of convenience and ease of use that brings us another npm malware incident every other month at this point.
- juliangmp 10mo agoThis is a real problem but I wouldn't blame the existence of good tooling on it. Sure you don't have this issue with C or C++, but thats because adding even a single dependency to a C or C++ project sucks, the tooling sucks. I wholly blame developers who are too eager to just pull new dependencies in when they could've just written 7 lines themselves.
- r_lee 10mo agoAnd in a way I think AI can help here, where instead you get just the snippet vs having to add that dep that then becomes a long-term security liability
- jandrese 10mo agoI remember hearing a few years ago about how developers considered every line of code the wrote as a failing and talked about how modern development was just gluing otherwise maintained modules together to avoid having to maintain their own project. I thought this sounded insane and I still do.
- krior 10mo agoOn the other hand you don't have developers handrolling their own shitty versions of common things like hashmaps or json-serializers, just because the dependencies are to hard to integrate.