Hacker News Reader

>The network isn't reliable, packages can changed innocently or maliciously, and mistakes happen.

Exactly. I'd like to know if andy_ppp reviews every update to packages that andy_ppp wants to include too.

Yes, I agree with you - there will always be some level of trust involved in your package manager. I think having a better standard library is probably the first desired solution, followed by npm keeping all old versions of a module around even after unpublishing and also some kind of review process build management system magic as part of your code review process.

It's all very easy to say of course and loads of people having been saying including small piece of code from your package manager is wrong. I'm saying it's not and giving reasons why. Trust your package manager or help make it trust worthy I guess.

Reply on news.ycombinator.com