undefined | Better HN

0 pointsslopinthebag2mo ago0 comments

Come on dude. The issue is the frequency and magnitude of these attacks. Log4Shell was also not a supply chain attack.

I looked at the Rust one for example, which is literally just a malicious crate someone uploaded with a similar name as a popular one:

> The crate had less than 500 downloads since its first release on 2022-03-25, and no crates on the crates.io registry depended on it.

Compared to Axios, which gets 83 million downloads and was directly compromised.

What an extremely disingenuous argument lol

0 comments

3 comments · 1 top-level

waterTanuki2mo ago· 2 in thread

What exactly do you think the argument is?

The issues have everything to do with npm as a platform and nothing with JS as a language. You can use JS without npm. Saying you'll escape supply chain attacks by not using JS is like saying you'll be saved from an car crash with a parachute.

PunchyHamster2mo ago

Well, this particular case could be wholly avoided if it didn't take 2 decades to get competent HTTP(S) client into core language

ric2b2mo ago

JS as a language is part of the problem because the standard library is so minimal that people need to use a lot more 3rd party libraries than they would in most popular languages.

j / k navigate · click thread line to collapse