Hacker News Reader

Comment by Wintamute | Hacker News Reader

A quick word of warning for anyone following this guide. You should never sudo npm install. That's giving root privileges to anyone that care's to upload code to the npm package registry. npm should work fine without sudo.

View on HN

Furthermore, it doesn't appear that any of these fad language repositories do any sort of package signing, so you're vulnerable not just to the people who upload their own code, but anyone who may compromise the mirrors, too, because even if you trust the source, there's no way of verifying the code hasn't been modified on the mirror.

And even the established ones which do require signing are not really trivial to use correctly: http://branchandbound.net/blog/security/2012/08/verify-depen...

I believe Clojars at least supports package signing, if not requires it. Was extremely useful in a code audit recently.

> fad language

lol

No doubt I've nothing better to do but stare aghast at "care's to upload code". It's a matter of deep mystery to me that folk adept at using languages demanding absolute grammatical precision treat their native language so carelessly.

Hah. I just reread my comment and stared aghast at my own error. Languages requiring absolute grammatical precision fail to compile with errors, not so Hacker News comments sadly. There, I just solved your mystery for you :)

Two assumptions you're making:

1) That English is the poster's native language

2) the poster did not use auto-correct

Reply on news.ycombinator.com