• 0 Posts
  • 6 Comments
Joined 2 years ago
cake
Cake day: August 4th, 2023

help-circle


  • PushButton@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    17 days ago

    There are two reasons. One is the name spacing that is inherent in Maven and bolted on to npm, and the enforcement or lack of enforcement in the repository. You can read more about that here https://blog.sonatype.com/why-namespacing-matters-in-public-open-source-repositories Then there’s the fact that npm runs “install” scripts when you download the component. This means if you can trick someone into grabbing your component by namespace confusion, typosquatting a name etc, you can get code run as soon as someone makes a mistake. Maven on the other hand only downloads the jars, it does not execute them. Taken together, you have an easier path to tricking people to grabbing your component with npm and that trick leads directly to code execution.

    —Brian Fox, Apache Maven PM & Sonatype cofounder & CTO

    I am on my phone, which is a bit too long to explain, but there are multiple facets to how NPM is worse than most packaging systems out there. There are enough on the web for you to browse and learn, if you are really interested to know more.

    But, here, I quoted a little something from Brian from Sonatype.



  • .NET is an excellent platform, c# and typescript are amazing (made by the same guy btw.), Visual Studio and VSCode are the best in their categories.

    Nothing really replace Excel (don’t even mention LibreOffice, that’s gonna make you look like a dunkey)

    Gaming and hardware support still better on Windows.

    The spyware are perfected like no other company can make them, as their nagging system, which you can’t really get rid of.

    Scaling your infrastructure on Azure is the easiest, as for scaling your bills, it’s demonstrated in TFA.

    Having some price hikes, from time to time, keep the excitement alive, see the latest github price hike tentative.