Who is downvoting a post based on what’s not in the post title or body? Besides, there are far more downvotes now than when I made my original comment, so it’s clearly not people being fooled by previous, now removed comments.
Also, I said or. It’s Either they’re against a community of answering questions openly, or have the reading comprehension of a potato…
Eh… IMO there’s a big difference between disagreeing about something reasonable, and disagreeing about the most basic tenets of what makes a community a community.
Kinda’ just making room for the sort of hypocritical ilk that ruin so many things. I can think of so many political and religious examples these days but I’ll refrain from fully describing such depressing things.
Who’s downvoting this?? Ban those moronic leeches. They’re either anti-community or have the reading comprehension of a potato, ffs.
I wouldn’t say pulling in higher versions is unsafe unless an attack like this succeeds. Otherwise it’s only an annoyance.
That sounds more like bad practices from the community. It definitely has ways to use exact versions. Not the least of which the lock file. Or the shrinkwrap file which public packages should be using.
Genuine question. How is NPM more vulnerable than other repos? Haven’t similar supply chain attacks succeeded at least as well as this one through GitHub itself and even Linux package repos?
lol I’ve understood the issue. The original post is not exactly nuanced. I’m sorry you feel so offended by my opinion that people who do not understand what a community of questions and answers should look like should not be welcome to people who understand what publicly answered questions should look like, but you do you.