undefined | Better HN

0 pointskkapelon8y ago0 comments

Usually you don't use maven deps directly. You have a registry in your company that caches maven packages for you and runs vulnerability scans on the binary. So the binaries you end up using are "tested" internally.

Is that how people use NPM?

Also maven central does NOT support unpublishing of binaries. So if you have version 1.2 of something and you have scanned it once for vulnerabilities, it should always be the correct one. Nobody can publish again 1.2 in the central repo

0 comments

3 comments · 1 top-level

kabes8y ago· 2 in thread

In every somewhat serious company I've worked they used a local npm cache like jfrog (usually same one that's used for maven) that can get scanned for security. So yeah, that's how people use npm.

Unpublishing within those companies is usually not allowed, in the official npm registry you can only unpublish within the first 24 hours of publishing, after that you need to request it by email.

kkapelonOP8y ago

>In every somewhat serious company I've worked they used a local npm

If that was the case for everybody, then left-pad would not have caused a problem for anybody. People would not notice anything wrong with their builds. The amount of github comments where people say that their production build just broke because of a missing package implies that people are NOT using NPM with a local registry

>in the official npm registry you can only unpublish within the first 24 hours of publishing

I don't believe this to be the case https://news.ycombinator.com/item?id=16087024

twelve408y ago

Just because it's a shitty common practice doesn't mean there isn't a proper way to do it (local repo). For example, there are tons of people who check in their secrets into public and private Github repos (including Uber eng), then they get jacked and complain. If they were smarter than that, "it would not have caused a problem for anybody". Doesn't really prove that what a lot of people do must be automatically good.

1 more reply

j / k navigate · click thread line to collapse