[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Security concerns with minified javascript code



 ❦ 26 août 2015 12:09 +0100, Philip Hands <phil@hands.com> :

> I note that this page:
>
>   https://wiki.debian.org/Javascript/Nodejs/Tasks/grunt
>
> was last touched in March, before the last thread in which you told us
> that packaging grunt is very hard:
>
>   https://lists.debian.org/debian-devel/2015/04/msg00123.html
>
> The closest grunt has got to being packaged seems to be a RFP:
>
>   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673727
>
> If nobody is actually working on this, then of course it's not going to
> happen, no matter how easy or hard it is.
>
> We should certainly not give Javascript some sort of special pass in
> order to make packaging of these unauditable packages easier, since that
> removes any real pressure for people to do the required work on grunt.

Despite being vocal on the subject, I was not part of the effort, so
don't take my word for anything else than my own opinion.

Nothing changed. Grunt is still a fast-moving target. We are unlikely to
get any happy user using the result since it will quickly become
outdated or missing some stuff. If it gets some traction, we will also
get Ruby-like angry users (remember, all those Ruby users that were very
confrontational with how Debian worked). And it's just about some
glorified make-like tool! No wonder the motivation is low.

[As a side note, the JS community is not the most flexible and friendly
 community in the world. There is a lot of friction points on how to do
 things with JS and on how to not do things with JS. I am pretty sure
 that most of the community will be hostile to the way we would do
 things in Debian. I prefer avoid taking fire and wait for them to
 slowly discover why we do things like we do. This is happening, slowly.]

But an increasing number of non-JS upstream projects come with some JS
that may require some of those dependencies. To continue to be able to
package them, a maintainer can either:

 1. package the whole Grunt ecosystem (and maintain it),
 2. cripple their package by substituting some components by a non-working
    version in Debian or,
 3. ship a pre-compiled/minified version of the library with sources.

I know this sucks, but if I have to pick my poison, I'll pick the last
one. I have tried the second solution in the past, nobody wins (more
work for the maintainer, more bugs, unhappy users).
-- 
The difference between the right word and the almost right word is the
difference between lightning and the lightning bug.
		-- Mark Twain

Attachment: signature.asc
Description: PGP signature


Reply to: