If the customers had been handed the software on day 1, by day 100 it would be full of security bugs, would need to be re-written for the new version of Node.js (the old one having been deprecated and also full of security bugs).
We don't have to make everything a javascript app running on the open internet. Though even an insecure node server could be perfectly fine if deployed on the corpnet behind a VPN...
Thats a very spicy threat model post the age of IoT.
Any stray device you may not even be aware of can rip that assurance apart.
A fully locked down network can in theory enable this however, very few enterprises actually are strict enough for this to be enforced across the whole network.
Comments
We don't have to make everything a javascript app running on the open internet. Though even an insecure node server could be perfectly fine if deployed on the corpnet behind a VPN...
Thats a very spicy threat model post the age of IoT.
Any stray device you may not even be aware of can rip that assurance apart.
A fully locked down network can in theory enable this however, very few enterprises actually are strict enough for this to be enforced across the whole network.