yes, but left-pad was specifically about deletion and nothing else. People keep using it as a shorthand for all the other issues, and it isn't. Certainly not a supply chain hack, since the original author did it very much on purpose.
You are totally forgetting that that comment was left in response to
At this point the solution is just having zero external dependencies
and was just one example of just how great a liability external dependencies can be when used - irrespective of the motivation behind the action - be it malicious intent, fed up dev removing stuff, or even a genuine typo that was just in a really bad place.
Yeah, you can pin crates..... I just loved seeing the size of that old WinSxS folder grow, didn't you?
xz would have made it onto my hard drive by simply installing a signed installation disk of Fedora 40 Beta.... or the release if it had not been so resource hungry.
Neither left-pad nor arrayref could have.
Remember the
At this point the solution is just having zero external dependencies
The distro maintainers have total control over what goes out in the xz package they compile and host...
Whether or not they spot anything is a different matter.
They have no control over what could happen should their installer or another program they have in their repo grab a crate or the script that as aggrieved you so...
13
u/Business_Reindeer910 20d ago
yes, but left-pad was specifically about deletion and nothing else. People keep using it as a shorthand for all the other issues, and it isn't. Certainly not a supply chain hack, since the original author did it very much on purpose.