An additional element adding to this chaos is the security vulnerability of npm packages. How often do we actually examine the package's code in detail before including it in a project?
Usually you don't use maven deps directly. You have a registry in your company that caches maven packages for you and runs vulnerability scans on the binary. So the binaries you end up using are "tested" internally.
Is that how people use NPM?
Also maven central does NOT support unpublishing of binaries. So if you have version 1.2 of something and you have scanned it once for vulnerabilities, it should always be the correct one. Nobody can publish again 1.2 in the central repo
In every somewhat serious company I've worked they used a local npm cache like jfrog (usually same one that's used for maven) that can get scanned for security. So yeah, that's how people use npm.
Unpublishing within those companies is usually not allowed, in the official npm registry you can only unpublish within the first 24 hours of publishing, after that you need to request it by email.
In every somewhat serious company I've worked they used a local npm
If that was the case for everybody, then left-pad would not have caused a problem for anybody. People would not notice anything wrong with their builds. The amount of github comments where people say that their production build just broke because of a missing package implies that people are NOT using NPM with a local registry
in the official npm registry you can only unpublish within the first 24 hours of publishing
Just because it's a shitty common practice doesn't mean there isn't a proper way to do it (local repo). For example, there are tons of people who check in their secrets into public and private Github repos (including Uber eng), then they get jacked and complain. If they were smarter than that, "it would not have caused a problem for anybody". Doesn't really prove that what a lot of people do must be automatically good.
I don't know if it's still the case, but one of the first things I learned about JavaScript was how it was inherently secure. Then I actually started using the language, and learned what utter bullshit that is.
I was taught that Javascript is safe because it has no input/output on its own, which is essentially true, but it's dangerous to work from that assumption since in the real world a program needs to have input/output to be useful.
The ECMAScript spec doesn't include details about its environment. You can run it in varying environments, each of which has different security criteria. For example, you can run a fully isolated JS VM that has no interactions with the real world, which is certainly quite safe. Node has full access to pretty much all the user's system resources, while the browser is a bit more sandboxed and restricted in what it can access.
Comments
An additional element adding to this chaos is the security vulnerability of npm packages. How often do we actually examine the package's code in detail before including it in a project?
Relevant article: https://hackernoon.com/im-harvesting-credit-card-numbers-and...
How is it different from maven deps?
Usually you don't use maven deps directly. You have a registry in your company that caches maven packages for you and runs vulnerability scans on the binary. So the binaries you end up using are "tested" internally.
Is that how people use NPM?
Also maven central does NOT support unpublishing of binaries. So if you have version 1.2 of something and you have scanned it once for vulnerabilities, it should always be the correct one. Nobody can publish again 1.2 in the central repo
In every somewhat serious company I've worked they used a local npm cache like jfrog (usually same one that's used for maven) that can get scanned for security. So yeah, that's how people use npm.
Unpublishing within those companies is usually not allowed, in the official npm registry you can only unpublish within the first 24 hours of publishing, after that you need to request it by email.
If that was the case for everybody, then left-pad would not have caused a problem for anybody. People would not notice anything wrong with their builds. The amount of github comments where people say that their production build just broke because of a missing package implies that people are NOT using NPM with a local registry
I don't believe this to be the case https://news.ycombinator.com/item?id=16087024
Just because it's a shitty common practice doesn't mean there isn't a proper way to do it (local repo). For example, there are tons of people who check in their secrets into public and private Github repos (including Uber eng), then they get jacked and complain. If they were smarter than that, "it would not have caused a problem for anybody". Doesn't really prove that what a lot of people do must be automatically good.
True, but the fact that NPM seems to be the only repository where packages can be "re-published" further exacerbates the bad practices.
https://status.npmjs.org/incidents/41zfb8qpvrdj
The fact that 9 packages could be "published over" _after_ the left-pad fiasco, shows lack of attention.
Tools should try to foster good practices, instead of worsening bad ones.
I don't know if it's still the case, but one of the first things I learned about JavaScript was how it was inherently secure. Then I actually started using the language, and learned what utter bullshit that is.
Who told you that? I don't think "inherently secure" is a thing in the tech industry.
I was taught that Javascript is safe because it has no input/output on its own, which is essentially true, but it's dangerous to work from that assumption since in the real world a program needs to have input/output to be useful.
Node.js adds that input/output.
The ECMAScript spec doesn't include details about its environment. You can run it in varying environments, each of which has different security criteria. For example, you can run a fully isolated JS VM that has no interactions with the real world, which is certainly quite safe. Node has full access to pretty much all the user's system resources, while the browser is a bit more sandboxed and restricted in what it can access.
Except in the case of Spectre/Meltdown...