This problem applies not only to editor plugins but all sorts of things nowadays: npm packages for Node.js devs in particular seem like a great way to get viruses, given how hundreds of dependencies get pulled in, sometimes to save 2 or 3 lines of code. Here is an example in the Node package for Postmark (an email service provider) which had a dependency for literally 4 lines of code:
https://github.com/wildbit/postmark.js/pull/14/files
As developers, we need to be willing to reinvent the wheel when needed, instead of blindly installing dozens of 3rd party packages. And we should vet things we install no matter what.
Comments
We've seen it happen before though: http://www.infoworld.com/article/2929732/open-source-softwar...
This problem applies not only to editor plugins but all sorts of things nowadays: npm packages for Node.js devs in particular seem like a great way to get viruses, given how hundreds of dependencies get pulled in, sometimes to save 2 or 3 lines of code. Here is an example in the Node package for Postmark (an email service provider) which had a dependency for literally 4 lines of code: https://github.com/wildbit/postmark.js/pull/14/files
As developers, we need to be willing to reinvent the wheel when needed, instead of blindly installing dozens of 3rd party packages. And we should vet things we install no matter what.
to be fair with that specific example, they changed from a purpose-built function, to a shell call including (albeit extremely simple) text parsing.
I'd generally prefer not to have the git(1) incantation hanging around in an unrelated function.
The dependency "git-rev" uses a shell-call too, so this PR doesn't change much apart from removing the dependency itself.
Here's the original code from the "git-rev" package: https://github.com/tblobaum/git-rev/blob/master/index.js