[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Security concerns with minified javascript code



Vincent Bernat <bernat@debian.org> writes:

>  ❦ 25 août 2015 22:46 +0100, Steve McIntyre <steve@einval.com> :
>
>>>Notably, one of the tool is Grunt and its myriad of plugins. Even if
>>>Grunt was in Debian, we would also need Gulp, then Broccoli, because in
>>>Javascript, there is always someone thinking that it should be possible
>>>to do better. We need to leave the Javascript ecosystem mature a bit
>>>more but in the meantime, a bit of tolerance would be appreciated for
>>>the some of us needing to package some javascript bits.
>>
>> Why should we be tolerating setups where it's not clear that we can
>> reproduce what's being shipped?
>
> We have done that for years for autoconf stuff.

Perhaps our standards have improved since?

Also, as mentioned elsewhere in this thread, people have gone as far as
packaging personal forks of autoconf in order to address this problem
with autoconf, so it's not something that we just accept (see bug #580190)

I note that this page:

  https://wiki.debian.org/Javascript/Nodejs/Tasks/grunt

was last touched in March, before the last thread in which you told us
that packaging grunt is very hard:

  https://lists.debian.org/debian-devel/2015/04/msg00123.html

The closest grunt has got to being packaged seems to be a RFP:

  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673727

If nobody is actually working on this, then of course it's not going to
happen, no matter how easy or hard it is.

We should certainly not give Javascript some sort of special pass in
order to make packaging of these unauditable packages easier, since that
removes any real pressure for people to do the required work on grunt.

Cheers, Phil.
-- 
|)|  Philip Hands  [+44 (0)20 8530 9560]  HANDS.COM Ltd.
|-|  http://www.hands.com/    http://ftp.uk.debian.org/
|(|  Hugo-Klemm-Strasse 34,   21075 Hamburg,    GERMANY

Attachment: signature.asc
Description: PGP signature


Reply to: