Re: Security concerns with minified javascript code

[Steve McIntyre <steve@einval.com>]

Craig Small wrote:
>On Wed, Aug 26, 2015 at 12:28:22AM -0700, Vincent Cheng wrote:
>> In that case, perhaps those who are most vocally in favour of
>> enforcing build-time javascript minification would care to work on a
>> debhelper addon to do so (similar to how dh-autoreconf makes dealing
>That to me seems the best way forward.

If the tools are available and packageable, then it shouldn't be too
hard. If they're not, then...

>> reproducibility by themselves. Choosing to whack people on the head
>> with Policy (or equivalent) instead is likely to be more
>> counterproductive than anything else.
>I tend to ignore it and find it annoying noise. You might as well say
>"abandon packaging certain types of webapps in Debian" for all the use
>some of the discussion is.

So you don't consider shipping programs/scripts/binaries of unknown
provenance in Debian to be a problem?

-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
"Further comment on how I feel about IBM will appear once I've worked out
 whether they're being malicious or incompetent. Capital letters are forecast."
 Matthew Garrett, http://www.livejournal.com/users/mjg59/30675.html