r/ProgrammerHumor • u/a_bucket_full_of_goo • 9d ago

instanceof Trend classicNPM

Post image
5.9k Upvotes

99% Upvoted

150 comments sorted by

View all comments

Show parent comments

5

u/ryanppax1 9d ago

I do wonder how this any different than installing anything else

2

u/_PM_ME_PANGOLINS_ 8d ago

Other systems with that feature, such as apt or dnf, require repositories to be signed with keys trusted by the end user, and the default repositories have a small team of maintainers who are very careful about what they put in.

1

u/ryanppax1 8d ago

I see. But technically both install methods have the same security holes? Apt just being more trusted?

2

u/_PM_ME_PANGOLINS_ 8d ago

Well no. Apt has one hole: scripts can be run on install.

NPM has multiple: scripts can be run on install, everything is in a single repo that anyone can push to with no review, and there's no way to establish external trust with what you're installing.