reply on: NPM security: preventing supply chain attacks | Snyk (2022) \ stacker news ~security

pull down to refresh

50 sats \ 8 replies \ @ek OP 13h \ parent \ on: NPM security: preventing supply chain attacks | Snyk (2022) security

Makes sense!

I'm just still confused because the cause doesn't seem to match the amount of confusion. How this can happen (incomplete lock file) doesn't seem to match how often it seems to happen (the internet is full with people complaining about it).

Did all of them also had someone who forget to check in changes to package-lock.json? How else could it happen to have an incomplete lock file? Who modifies their package-lock.json manually or undoes the changes to it (git checkout package-lock.json) and then wonders why npm install changes it again or ...?

But maybe I'm contributing to the confusion around it right now haha

I wish the documentation was more clear when npm install changes package-lock.json. I don't see it mentioning what happens if the lock file is incomplete.

172 sats \ 7 replies \ @k00b 13h

ek is learning that most people suck at their jobs in real time :)

132 sats \ 0 replies \ @WeAreAllSatoshi 13h

ROFL - yep

0 sats \ 5 replies \ @ek OP 13h

but can so many people really suck that much??? lol

you have a point

155 sats \ 4 replies \ @SimpleStacker 13h

I'm not a professional programmer, but when I worked part time at a tech company I was surprised that I was better at it than some of the full-time programmers there :\

0 sats \ 3 replies \ @k00b 13h

I think sucking at things is a personality trait more than anything else

0 sats \ 2 replies \ @SimpleStacker 13h

That's... kinda sad? The idealistic part of me would like to believe that sucking is due to skill/personality mismatch, rather than something inherent about the person, and that everyone can find a niche that they don't suck at.

30 sats \ 1 reply \ @k00b 13h

You're right I think. I was having fun being pessimistic

Perhaps the personality component that matters is being open to finding a good skill/personality match.

50 sats \ 0 replies \ @SimpleStacker 12h

I think the more realistic (cynical?) take would be that these people are good at what they do... but what they're doing is maximizing personal gain while minimizing personal effort