Anyone done a security audit on this yet?
Of course every package used in any code that contains sensitive data should be audited along with its dependant, but I see no reason to be more afraid of this particular package than anything people happily install from npm.
They have international agreements with a number of countries for surveillance.
This means that unless an app is completely hosted, in all parts from source code to production, in a privacy-friendly country, on servers provided by a privacy-friendly company and the app is made by a company in similar conditions, the US and EU have all they need.
Chinese companies absolutely do not have this track record. Chinese companies are essentially an extension of the heavy hand of the Chinese Communist Party.
I just hope the various cryptominers that get shoehorned in to umpteenth child dependencies fight against each other...
If everything was like the NPM meme where you install a package to check if something is true, then your LOC for that module with be quite limited.
However a single dependency is often big itself, and the 50 dependencies it has are also quite big. The LOC in the dep-dep is not the same as if it was written by hand in the dep.
So if you wrote your dep by hand you may use, say, 500,000 LOC - but with the tree of dependencies not being a 1:1 to what you use, you have to audit more like 2Mil LOC. Perhaps an audit could be aided by some sort of tree-shaking scenario, where all non-used code is removed, leaving you with the real 500,000 LOC that needs review.. Would be interesting.
I've been having this same problem with Rust lately. Frankly, I think it's true for any package platform you use.
Right, people act like node_modules is extremely special. They open the folder and say "Look at all of the files, what a mess!" as if other languages don't have this. Just in most other languages it's more hidden from you.
Since the project hasn't acknowledged the forking, they already have given good reason to be suspicious.
Huh? I'm replying to someone inquiring why someone else didn't review a fork. Aka, the GP was focused on the Fork aspect of Hippy, and the Parent asked about React, as if React was a fork.
I think you misunderstood the comment chain. I was not even talking about security issues or how that affects forking. I was merely replying to another discussion about forking, and how React is viewed in that "forking light".
Vagueness and confusion all around, haha.