Holy shit until very recently npm docs actually recommended chowning /usr/local to a random user (or whatever prefix node was installed into). Did they just silently implement this in code?! https://web.archive.org/web/20171214001907/https://docs.npmjs.com/getting-started/fixing-npm-permissions …
-
-
Show this thread
-
LOL, they have a magical mkdir-and-fix-permissions function that *explicitly* chowns *recursively* to the uid/gid that called sudo instead of root in that case. https://github.com/npm/npm/blob/d3095ff20b8ea01e7fbf93a4a697a04fea77d8e6/lib/utils/correct-mkdir.js#L55 … and then they do shit like run it on the installation path 'etc' dir. https://github.com/npm/npm/blob/d3095ff20b8ea01e7fbf93a4a697a04fea77d8e6/lib/config/core.js#L156 …
Show this thread -
This isn't a subtle bug, this is literally working exactly as intended and written and clearly not tested by anyone on a real system.
Show this thread -
One of the developers is asking for 2 days to fix the problem. It took me 5 minutes to find that. On the GitHub search interface. And I don't even do node. Never looked at the npm codebase before. 2 days, seriously?
Show this thread
End of conversation
New conversation -
-
-
maybe they're telling people to docker all the things
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Unpopular opinion: most stuff should never be run sudo'd to root, and this should be enforced by it randomly wrecking shit with the system when this is violated.
-
unpopular opinion, it looks like a devop took control of this code.
End of conversation
New conversation -
-
-
unix permissions aren't webscale enough for npm
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Hot take: there are no security boundaries on Linux anyways, and people stopped caring long time ago. User, root, kernel, what is difference?
-
Isn't that encoded in the user id somehow? Like, your account is the first one, so it's number 1, root is 1337, apache2 is 443, nginx is 80, and NSA reserved a ton of other numbers for future use.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.