Open source strikes again

Open source strikes again

Attached: pp.png (1030x802, 140.58K)

Other urls found in this thread:

theregister.com/2022/05/24/pypi_ctx_package_compromised/
drewdevault.com/2022/05/12/Supply-chain-when-will-we-learn.html
twitter.com/NSFWRedditVideo

>php ass
don't say you weren't warned

here's something better than the twitter shit
theregister.com/2022/05/24/pypi_ctx_package_compromised/

Attached: 1631399826506.png (1032x2249, 468.37K)

this is why i write my own libraries

LOL

>trusting python
Doesn't this keep happening?

>Doesn't this keep happening?
with npm, yes. its not as common with pip

Debian solved the packaging issue some 30 years ago
creating a different package manager for each tech stack and having devs also be maintainers was a terrible idea
we're stuck with more security issues and killed the LTS model by design simple people just keep pushing shiny new stuff (tm) instead of making a stable release and pushing security patches to it

I see
Still people need to do research I've always had a fear of these third party package mangers because by design they make it easy to fuck people over

Add it to the list
drewdevault.com/2022/05/12/Supply-chain-when-will-we-learn.html

>3 gorillion
literally what is ctx, no way it had that many users

drewdevault.com/2022/05/12/Supply-chain-when-will-we-learn.html

Drew DeVault is right, let the distros do the job of distributing the packages.

quality of life module that lets you access dictionary keys using dot operators
(poo.pee instead of poo["pee"])

if you don't use lock files and individually review each updated package then you deserve this
>b-but i have 39632 packages and i NEED the latest
npm devs need not apply

Do you really?

no

pacman -Qs rustdecimal foreach node-ipc npm rc coa ua-parser-js mitmproxy2 pretty_color bb-builder event-stream colourama eslint-scope acroread
^pacman^yay

based

Currently doing a simple DB app for a small business,
pure nodejs, no external libraries
>custom server, can serve web pages + manage API calls
>custom DB
>custom login system
>custom encryption
>custom logging engine
>custom client side page
>well I am using a css theme, but it is frozen and will never be updated ever

So it is just the nodejs that can fuck things up now

So it only hit JS refugees? That doesn't sound too bad.

>custom encryption
I assume you implementing a standard and not trying to make your own encryption algo right?

>ctx
MIT license
>phpass
MIT license

Really makes you think

C doesn't have this issue

I'm just doing a bunch of XORs, what could possibly go wrong?

>>custom DB
Is it one big JSON file or do you prefer to split it up?