BLU Discuss list archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Discuss] node.js and npm on Debian?
- Subject: [Discuss] node.js and npm on Debian?
- From: dsr at randomstring.org (Dan Ritter)
- Date: Tue, 13 Feb 2018 14:58:13 -0500
- In-reply-to: <chxd1183d12.fsf@sdf.org>
- References: <mailman.5.1518541203.12900.discuss@blu.org> <79192ce06b0d6a486bee904a328aafb8.squirrel@swarm00.ci.net> <20180213190641.5vrfqhziucyuq6uc@randomstring.org> <chxd1183d12.fsf@sdf.org>
On Tue, Feb 13, 2018 at 07:28:09PM +0000, Mike Small wrote: > Dan Ritter <dsr at randomstring.org> writes: > > > On Tue, Feb 13, 2018 at 10:51:41AM -0800, Rich Braun wrote: > >> Kent Borg <kentborg at borg.org> asks: > >> > But I can't figure out how to install npm. When I search for > >> > installation instructions they all seem to want me to pipe a curl > >> > command into a sudo bash. Huh? That's scary as hell. > >> > >> Let others do the installation for you: my go-to technology for this is > >> Docker. First get docker installed > > > > And transfers those headaches to your security and ops teams. > > > > Would Nix or Guix (run from within Debian -- guessing the former would > be more likely to have npm) be a better substitute? This was one of the > issues mentioned against things like Docker when we had that Guix talk a > couple years back. I have no first hand experience myself, only curious. Nix/Guix are designed to deal with these problems. You need to be able to keep track of all the source code and build tools that go into a deployment, in such a way that you can learn about a problem and figure out the extent of your exposure. There's no reason for that not to be available in a container system, it just isn't done that way routinely. Similarly, Go statically links everything, so you need the same tracking procedure plus the ability to rebuild all your Go programs in accordance with your security policy. Automatic methods beat manual methods, widely-used automatic methods beat local hacks. Wide support is key. -dsr-
- References:
- [Discuss] node.js and npm on Debian?
- From: richb at pioneer.ci.net (Rich Braun)
- [Discuss] node.js and npm on Debian?
- From: dsr at randomstring.org (Dan Ritter)
- [Discuss] node.js and npm on Debian?
- From: smallm at sdf.org (Mike Small)
- [Discuss] node.js and npm on Debian?
- Prev by Date: [Discuss] node.js and npm on Debian?
- Next by Date: [Discuss] node.js and npm on Debian?
- Previous by thread: [Discuss] node.js and npm on Debian?
- Next by thread: [Discuss] node.js and npm on Debian?
- Index(es):