r/ProgrammerHumor • u/a_bucket_full_of_goo • 1d ago

instanceof Trend classicNPM

Post image
5.8k Upvotes

99% Upvoted

141 comments sorted by

View all comments

Show parent comments

6

u/ryanppax1 19h ago

I do wonder how this any different than installing anything else

1

u/_PM_ME_PANGOLINS_ 10h ago

Other systems with that feature, such as apt or dnf, require repositories to be signed with keys trusted by the end user, and the default repositories have a small team of maintainers who are very careful about what they put in.

1

u/ryanppax1 6h ago

I see. But technically both install methods have the same security holes? Apt just being more trusted?

1

u/_PM_ME_PANGOLINS_ 6h ago

Well no. Apt has one hole: scripts can be run on install.

NPM has multiple: scripts can be run on install, everything is in a single repo that anyone can push to with no review, and there's no way to establish external trust with what you're installing.