Hacker News
points by alienbaby 15 hours ago | 0 comments
isnt that kinda like downloading and using software a team you have no knowledge of has produced and released?

All you can go by is 'does it do what it says it does'

[–] ang_cire 15 hours ago
Yeah, all these devs pretending you can only trust code you understand, then going and pulling in 1000 random npm deps...
[–] batshit_beaver 14 hours ago
When people install npm packages, they typically only install ones the community trusts. These packages have clear APIs, open source, good docs, test coverage, security checks, and, importantly, usually no undocumented side effects.

Engineers introduce these packages into their own projects that have far fewer of the above guarantees than OSS, are built under pressure from deadlines, and have a constantly churning set of maintainers.

I think from the perspective of a business its own code does call for greater scrutiny than its dependencies.

[–] ang_cire 14 hours ago
> When people install npm packages, they typically only install ones the community trusts.

This is wishful thinking. Devs add in dependencies to do mundane stuff all the time, regardless of provenance.

As others pointed out, the default install for many modern web dev frameworks includes hundreds of dependencies.