OverviewExploreTrending
Nostr Archives
OverviewExploreTrending
Zsubmariner13d ago
For end-users, yeah, the package manager is taking care of it. Even though the key layer actually sucks still, at least it's there. But most devs are way too blasé about supply chain security. Especially in js and rust. I cringe every time I see one of those pipe curl to bash oneliners.
💬 1 replies

Thread context

Root: cd9dd6de9fe7…

Replying to: 86cfc114deca…

Replies (1)

ChipTuner13d ago
`dnf repo info` > I cringe every time I see one of those pipe curl to bash oneliners. Yup. Side note, I use Taskfile.dev in my projects and it has a neat side effect that end-users or contributors can do a --dry-run to see all of the commands the "script" will run before before it does them, and it will echo them during a normal build. For me it's just a nod to my users imo.
0000 sats