Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It also supports preinstall and install scripts, for more obvious reasons.


I don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.


NodeJS isn't very sandboxed. Many "dev libraries" are native and will either download and link to binary blobs, or build e.g. C code, which AFAICT is what all the various install scripts are for.


It seems like a bad design choice, that, besides allowing for running untrusted code directly at download time, also makes it difficult to properly mirror artifacts, and I'd assume, make platform portability inconsistent, at best.


dependency checking isn't simple




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: