Embedded Malware in Coa

Post by cutemonster » Fri, Nov 05, 2021, 7:24 PM UTC

heurisko wrote: post #57

chakkepolja wrote: post #54

Earlier quoted context omitted.

I will be downvoted to hell for saying this. But javascript ecosystem is where most newbies come. (Low barrier to entry and it also seems hip). With no regards to security, maintainability or reliability, fashion chasing blog-happy hipsters. The amount of churn in JS ecosystem, security incidents like this and general crappiness of websites can be generally explained by how immature these hipsters are.

PHP has a similarly low barrier to entry, but doesn't seem to suffer as much as JS. Perhaps because dependencies are more curated in PHP due to clusters of dominant frameworks, rather than a proliferation of smaller libraries.

Post by schemescape » Fri, Nov 05, 2021, 10:35 PM UTC

inbx0 wrote: post #34

Reminder that people should seriously consider disabling the install-scripts. Personal system-wide config: npm/yarn config set ignore-scripts true -g and add & commit a .npmrc/.yarnrc file with ignore-scripts true Yes, this will cause headaches in some (increasingly rare) cases where some package actually needs those scripts. You can fix this with custom install scripts that take care of running install for those spe…

Post by schemescape » Sat, Nov 06, 2021, 4:27 AM UTC

schemescape wrote: post #83

inbx0 wrote: post #34

Reminder that people should seriously consider disabling the install-scripts. Personal system-wide config: npm/yarn config set ignore-scripts true -g and add & commit a .npmrc/.yarnrc file with ignore-scripts true Yes, this will cause headaches in some (increasingly rare) cases where some package actually needs those scripts. You can fix this with custom install scripts that take care of running install for those spe…

NB: Setting “ignore-scripts” globally means you can’t even “npm run” scripts manually, for packages you’re authoring (or at least that appears to be happening for me).