Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

doc: add minutes for meeting 28 January #140

Merged
merged 1 commit into from
Jan 30, 2019

Conversation

mhdawson
Copy link
Member

No description provided.

@dominykas
Copy link
Member

dominykas commented Jan 29, 2019

Missed the call due to an epic 🤦‍♂️, but I can see a related discussion - coincidentally last week I implemented this: https://www.npmjs.com/package/allow-scripts

tl;dr:

fwiw, I hope I can deprecate that package soon, as --ignore-scripts + allowScripts should be the default in the package installers.

Not sure how much in scope this is for package-maintenance, probably more of a Security WG thing (will try to find a relevant issue there...)

@ljharb
Copy link
Member

ljharb commented Jan 29, 2019

@dominykas you'd have to pursue that change in both npm and yarn.

@dominykas
Copy link
Member

dominykas commented Jan 29, 2019

Yarn already has an RFC PR for that, npm has the thread that was mentioned in the call - this can serve as a userland ref/PoC impl to get the standards rolling (it does solve a need at work for me).

I agree security wg doesn't have levers to pull this off, but advocacy and awareness is still useful? And --ignore-scripts as a best practice (at least in CI) is also recommendable?

(Are we going borderline offtopic?)

@Eomm Eomm self-requested a review January 30, 2019 07:06
@mhdawson mhdawson merged commit d6b7c03 into nodejs:master Jan 30, 2019
@rxmarbles rxmarbles linked an issue Feb 19, 2020 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Node.js Foundation Package Maintenance Team Meeting 2020-01-28
5 participants