311–320 of 1001 posts
Earlier quoted context omitted.
Why does a new version break projects without action by the project owners? In Go you would have to explicitly update to the broken version.
Because npm install has the insane default behavior of adding a fuzzy qualifier to your package.json, for example ^6.0.2 means all of the following versions are accepted: 6.0.2, 6.0.9, 6.7.84
Earlier quoted context omitted.
Living wage? haha, more like 100 peoples living wage.
In America, most unskilled software developers make somewhere in the $80k to $140k range. A living wage is around $20k for absolute bare minimum essentials. Skilled devs still get around $200k. Point is, maybe 10 people. And that’s if you like ramen.
Even in America outside of the coasts and outside of FAANG, making $140-$150+ as a senior developer is very good (and compared to almost all other industries is absurd) - salary.com which doesn't just rely on self-reported info as levels does reports the median salary + bonus for senior software engineers as $120k
https://www.salary.com/tools/salary-calculator/senior-softwa...
Outside of the US, even in more expensive places in the EU, even the equivalent of $100k for a super senior lead architect would be Very Good - I don't know a single SWE in the midwest in the US - including senior embedded systems engineers working on medical devices, senior firmware devs working on networking equipment, or any web engineer that makes more than $175k and I know plenty of Very Good senior full-stack web devs that make $125-$150
$125k a year is still a top of the top salary in the US, so don't cry for them tho
How is it not a legal issue to intentionally DOS customers servers? I would send a complaint to the California DA’s office for hacking; the laws against which in CA are very liberal.
Because you chose to download and execute it, without due diligence, while the license states that the code comes with no warranty whatsoever?
GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724
I don't understand why. It's his code to break if he wants. But I guess when you use a social media service to host your code these are expected and normal results.
I think as JS developers, this should be a wake-up call, to never trust npm semantic versioning if your project it's critical. In this case, it's a dev who decided to use his right of doing political activism at the cost of his reputation. But this it's a best-case scenario. Another dev of a popular NPM library could get hacked, and insert malware. I wonder if there are zombie servers out there mining crypto or doing…
How come npm packages aren’t immutable and signed just like rubygems? Totally understand the guy though
I'll admit that I cracked up pretty good over this, and am glad that I'm not working in JS/TS every day anymore for reasons among these kinds, but I am firmly on the developer's side on this one. Github suspending the developer's account is well within the realm of the type of questionable actions I expected out of Github after its acquisition by MS and only makes me feel even better about my long-ago move to Gitlab…
Earlier quoted context omitted.
look at diffs?
Can you really say, with a straight face, that you inspect the diffs of your entire dependency closure every time you deploy an update? With the level of scrutiny required to detect a maliciously-obfuscated security exploit? If you can, you're an infinitely more diligent developer than I am, that's for sure.
> With the level of scrutiny required to detect a maliciously-obfuscated security exploit
Nope. Not paid to do that and I have not been given any such responsibility.
That said, I think the attack vector on this is very low.
Packages are rarely updated to the latest version.
We don't use a lot of packages.
We mostly use packages from trusted sources.
We use packages that are open source.
Earlier quoted context omitted.
In general, warranties only relate to accidental problems and have nothing to do with intentional sabotage.
code is speech, stop listening. This is no different from a person erasing their FB history and saying something someone doesn't like.
GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724
People who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion?