David Sherret

Software developer. Prev @deno_land. Working on ts-morph, dprint, and more.

[David Sherret @DavidSherret]

@carllerche @rough__sea Yeah, the builds were already published as github action assets for use in the test jobs.

[David Sherret @DavidSherret]

@darcy It turned out to be an issue with the git executable in my case. It was just taking a long time and I wasn't waiting long enough.

[David Sherret @DavidSherret]

Reporting the same security issue to pnpm vs bun:

pnpm acknowledged it quickly, shipped a fix, backported it, and published an advisory.

bun never acknowledged, silently fixed this and another issue I reported, has not published advisories.

One takes security more seriously.

[David Sherret @DavidSherret]

@darcy Yeah, I’ll look into it tomorrow when I’m back at my computer. I tried the latest version I think, but maybe I was accidentally using an old version.

[David Sherret @DavidSherret]

@darcy The issue was caused by an optimization to use https://t.co/kQG61HO1fW for github git dependencies (and something similar for gitlab).

[David Sherret @DavidSherret]

@darcy I think I tried out all the pkg managers I could think of at the time. Right now, vlt spins indefinitely resolving deps for me. Advisory is here: https://t.co/Kz1GQuCjg7

For bun, there was a second more critical issue where it was not storing checksums for any https dependency.

[David Sherret @DavidSherret]

@zack_overflow Long term yes, short term probably not after a ton of churn. They did say "for a year" and that seems sensible.

[logan @loosenedspirit]

@thdxr they’re not issuing CVEs for shit like this man, it’s negligent

[David Sherret @DavidSherret]

@loosenedspirit @thdxr I don't know how anyone trusts it and it's been this way for a while. Obviously lots of good perf ideas in Bun, but I remember in Deno we looked at adopting a few of them and sometimes it was a correctness or probably a security issue.

[David Sherret @DavidSherret]

@StartupSpells @boshen_c @JoviDeC Not a good comparison.

> And majority of the world hates change.

Changing the underlying registry and nothing else drastically changes the semantics for users—`pnpm install <package-name>` no longer means what it's meant in the past.

[David Sherret @DavidSherret]

@StartupSpells @boshen_c @JoviDeC Plus, saying "I want this package from jsr and not npm" by using `jsr:` is not that hard for users. People aren't that stupid.

[David Sherret @DavidSherret]

@StartupSpells @boshen_c @JoviDeC Existing clients using a new registry by default sounds terrible and will make the security situation worse because different packages will be installed based on what registry is configured. In existing tools, integrating a new registry should not introduce ambiguity.

[David Sherret @DavidSherret]

@wesbos @1Password It automatically fills the password for me now.

[David Sherret @DavidSherret]

@wesbos @1Password Well that sucks 😂

[David Sherret @DavidSherret]

@boshen_c @JoviDeC JSR has an npm compatibility layer that works the same as npm and it works in pnpm and yarn at `jsr:`. Are you suggesting something where people can swap https://t.co/BmtV23woEt for an entirely new registry with different packages?

[David Sherret @DavidSherret]

@victorbayas @IntCyberDigest Avoid using pull_request_target https://t.co/yo8rzDgwiC

[David Sherret @DavidSherret]

@dpc_pw @IntCyberDigest So it's pull_request_target along with checking out the PR branch. That caused it to run on the main branch with secrets and the main branch workflow file did a checkout of the PR branch https://t.co/lhQoFkMs7l

[David Sherret @DavidSherret]

@dpc_pw @IntCyberDigest So it's pull_request_target along with checking out the PR branch. That caused it to run on the main branch with secrets and the main branch workflow file did a checkout of the PR branch https://t.co/lhQoFkMs7l

[David Sherret @DavidSherret]

@dpc_pw @IntCyberDigest pull_request_target has access to the github_token (https://t.co/G625wnUiEl). Looks like they’ve been fixing it https://t.co/LcMaT1L0P3

[David Sherret @DavidSherret]

@trq212 I don't agree with some of the points because Markdown supports HTML tags.

[David Sherret @DavidSherret]

@ThePrimeagen @slimjimmy @TheRastrian I had 66, but I sold it before the hack to buy a case of beer.

[David Sherret @DavidSherret]

Also, the cross-platform shell has been extracted to a dedicated JSR package. https://t.co/KQKkoKDqpp

[David Sherret @DavidSherret]

The latest version of dax (https://t.co/FN47KnnbCf) can show a scrolling view of the last N lines when executing a command. This is especially useful when running multiple commands in parallel.

[David Sherret @DavidSherret]

It works well with progress bars, selection, and other features that dax provides.