Devs unknowingly use “malicious” modules snuck into official Python repository

Post by dozzie » Mon, Sep 18, 2017, 7:21 PM UTC

chii wrote: post #72

seanp2k2 wrote: post #54

Earlier quoted context omitted.

The culture around what should be in a package is vastly different. Node has left-pad. Debian has stuff like Apache. Sure, those are radical examples, but the barrier to entry for Debian is pretty high (as is the standard for quality) vs npm where anyone can put whatever out there. How do things like left-pad even come to be widespread dependencies? Does the node development process involve a lot of "gee I wonder if…

But the large number of packages available, even for seemingly trivial features, are what makes NPM popular and successful. You jest at left-pad, but there's real value in simple libraries they might only be "a few lines of code" because an app is made up of a large amount of "simple features" strung together. Not to mention the code reuse factor. If npm took the route of debian's verification/certification, you migh…

Post by [deleted] » Tue, Sep 19, 2017, 12:13 AM UTC

grrowl wrote: post #28

reificator wrote: post #20

Earlier quoted context omitted.

NPM is my primary reason for not using NodeJS. I installed a specific package in an empty project and got over 690 dependencies. For running `npm install {package-name}`. What's worse is that I skimmed the tree to check for anything particularly heinous, but there was nothing that stood out as unneeded. With such a tiny stdlib, especially out of the browser environment, there's not really a better alternative than to…

You specifically chose a large dependency with many sub-dependencies, so yes, that will happen. There's also the risk of installing an outdated, unmaintained dependency. Do a little research — check the package's npm page, assess whether it's too light or too heavy for your use-case. Check its github page to assess whether it's currently maintained (and how important that is for your use-case). If you're unsure, look…

Post by ageofwant » Tue, Sep 19, 2017, 8:17 AM UTC

Stranger43 wrote: post #108

ageofwant wrote: post #76

Earlier quoted context omitted.

Bulshit. The benefits of this "casual culture of pulling in hundred of dependencies" vastly outweigh the harm. I'll be assembling another $6000 job that will take me maybe 12 hours to complete while you write your compiler, from scratch, in your own assembler, made for your own cpu, that you youre gonna cook up from a bucket of sand you collected yourself, from a sandpit you trust.

the problem is that your $6000,- one off will cause your client to face either completely trivial to exploit production systems or exponentially growing operating costs, because lets face it you are going to provide zero hours of post deployment support for that task.

Post by swiley » Tue, Sep 19, 2017, 2:41 PM UTC

tokenizerrr wrote: post #98

dom0 wrote: post #52

Earlier quoted context omitted.

> It's like saying the good thing with not having a cellphone is that you avoid a lot of fight with your girlfriend cause you can't talk as much. I can't quite see what's wrong with that...

Do you have a cellphone? If so, throw it into the trash right now.

Post by Can_Not » Wed, Sep 20, 2017, 10:29 PM UTC

camus2 wrote: post #55

Well pip has the same problem as NPM : no namespaces by default. But NPM is worse with all its dependencies of dependencies. Composer (PHP) got both namespace and dependencies right: flat dependencies, it's up to the developer to resolve conflicts, not to the package manager to create insane dependency trees. It leads to more stable packages and make spotting fakes easier.