undefined | Better HN

0 pointsbigiain5y ago0 comments

I would like to draw to your attention the magnitude of that task, with a recent link from another HN comment discussion:

http://npm.anvaka.com/#/view/2d/react-native

and

https://github.com/microsoft/react-native-windows/blob/maste...

Turns out left-pad.js is on line 8571 of that 14+k line yarn.lock file.

How many React Native developers do you suppose have reviewed every line of code in every library referenced in that file? (Or even how many engineering teams at any React-using Unicorn size startups or FAANG have exhaustively reviewed all those lines of code?)

Is FaceBook a "trusted publisher" of React? Is npm a "trusted publisher" of Node libraries? Was Azer Koçulu a "trusted publisher" of left-pad.js?

(And it's turtles all the way down. Is Microsoft a "trusted publisher" of Windows? Is Dell a "trusted publisher" of bios? Is Intel a "trusted publisher" of cpu micro-code? Is Western Digital a "trusted publisher" of hard drive firmware? Is every unnamed silicon manufacturer and pcb and subcomponent assembly house a "trusted publisher" of the embedded code in their network card/usb hub/battery management chip/whatever?)

I _do_ agree with you, but these days it's very difficult, at least in much/most of the software world, to determine the height of the people/libraries claiming to be "giants" offering their shoulders to stand on. (And like with React, it's more and more difficult to determine which actual giants are standing on bedrock, and which have a foothold with quicksand uderneath it...)

0 comments

wolco5y ago

In react's case you put your trust in facebook and because of the size most issues get discovered and someone has an article on how to fix before breakfast.

When you include left-pad in your own project you should audit it. In the end you are the only line of defense. With react it's larger so you can trust others.

gpeal5y ago

I think that's exactly the problem because of things like this: https://twitter.com/ZacSweers/status/1259176799235387393?s=1...

I am the sole maintainer of airbnb/lottie-android despite the fact that I left the company almost 2 years ago and it is used by tens of thousands of companies including Google, Samsung, Microsoft, Uber, Netflix, and countless others.

wolco5y ago

Let's say this doesn't get updated I don't see a problem. It will continue to function as it is until it gets outdated and replaceed. Let's say it changes and does something evil, hopefully Google, Microsoft will catch the issue. If they don't someone will and people will stop trusting react or whatever product pulls these changes in.

Doing it yourself I would just freeze versions.

---------

In this case I find it odd for someone to keep maintanier status for a company repo they no longer work for 2 years after leaving.

I would have forked and introduced new changes in my own repo if I cared about the project. Let others follow if they desire new updates or force airbrb to assign someone to update. or better get airbrb to pay you to keep updating.

1 more reply

j / k navigate · click thread line to collapse

0 pointsbigiain5y ago0 comments

I would like to draw to your attention the magnitude of that task, with a recent link from another HN comment discussion:

http://npm.anvaka.com/#/view/2d/react-native

and

https://github.com/microsoft/react-native-windows/blob/maste...

Turns out left-pad.js is on line 8571 of that 14+k line yarn.lock file.

Is FaceBook a "trusted publisher" of React? Is npm a "trusted publisher" of Node libraries? Was Azer Koçulu a "trusted publisher" of left-pad.js?

0 comments

wolco5y ago

In react's case you put your trust in facebook and because of the size most issues get discovered and someone has an article on how to fix before breakfast.

When you include left-pad in your own project you should audit it. In the end you are the only line of defense. With react it's larger so you can trust others.

gpeal5y ago

I think that's exactly the problem because of things like this: https://twitter.com/ZacSweers/status/1259176799235387393?s=1...

wolco5y ago

Doing it yourself I would just freeze versions.

---------

In this case I find it odd for someone to keep maintanier status for a company repo they no longer work for 2 years after leaving.

1 more reply

j / k navigate · click thread line to collapse