Oh, so it's not only "JavaScript bad and npm bad". Apparently, if your language uses third party dependency registry, you are prone to malicious code, regardless if it's Javascript or not.

Use containers for development. And reduce the amount of third party deps you import into your projects. This is only going to get worse.

▲

patmorgan23 2 hours ago | parent | next [-]

Pulling in lots of dependencies creates this kind of risk regardless of the ecosystem. That being said in the JS/NPM world you tend to have a LOT more dependencies (especially indirect ones) than other languages. I saw someone do a cursory analysis and JS/Node projects tend to have 5x the number rust or ruby projects.

This is really a cultural problem not a technical one.

▲

insanitybit 2 hours ago | parent | prev | next [-]

If it weren't a registry it would be ./configure scripts and makefiles. The issue is that sandboxing technology is kinda shit (especially x-plat) and languages don't build it in by default.

▲

mabini 2 hours ago | parent | prev [-]

npm is mentioned 5x on this page.

Just wondering, whenever things go wrong with Rust - why do you all (Rust devs) point the finger at JavaScript?

It’s the weirdest form of projection. More than 1 person is doing it here. It’s like the second Rust hits a failure mode you immediately go “well JavaScript is worse!”

Like that has anything to do with your failure (even if it was true)

Edit: 7 times and counting

▲

swiftcoder 2 hours ago | parent | next [-]

> Just wondering, whenever things go wrong with Rust - why do you all (Rust devs) point the finger at JavaScript?

I know it is almost a sport to point fingers at the "evil rust evangelists" on HN at this point, but a quick look at the fnoef's comment history would show you that they are not a rust person.

Your account, on the other hand, is a sock puppet created specifically to bitch about rust. Pot, meet kettle?

	▲	mabini 23 minutes ago \| parent [-]
		What are you on about? What does some guy's unrelated comment history have anything to do with what we're talking about? You refuted nothing I said. 19 mentions of "npm" now.

▲

ux266478 2 hours ago | parent | prev [-]

You're literally replying to someone saying npm is unfairly called out.

Rust developers aren't the ones who have problems with it. Otherwise they likely wouldn't be using Rust in the first place. I don't see anyone saying JavaScript is worse about it either, more that they're the same.

Why are you getting so defensive about it?