mr. TIM
not really a js dev, but claude moved me to pnpm. what is it and why should i want it?
1 2
Samuel
it’s a package manager. it’s in charge of putting your deps into node_modules. compared to npm/yarn, pnpm is way faster and has way more security features
1 3
KiloQubit
Does it still allow installation scripts to perform arbitrary actions on your machine?
2
Samuel
no you have to manually whitelist the ones that are allowed to run postinstall scripts
1 1
KiloQubit
I guess it's a little better, but I think it should be way more restrictive. It should prevent the scripts from touching any files outside of that package's directory, or open any network (or unix socket) connections to anything, or seeing any environment vars other than its own,
1
KiloQubit
Or seeing current processes or being able to send signals to processes other than its own.
fry69
Like switching from an old, trusty, but also rusty and squeaking bicycle to a modern electric vehicle.
1 1
fry69
Depends on your use case. If you want to transport things or drive long(er) distances, then bikes quickly loose their advantage. In this analogy the EV stands for more capable (huge monorepos are easier to manage), and the downsides (more bulky, lots of knobs to control and learn, etc) also fit.
tbisuk.bsky.social
Don't really understand much about this sort of thing. Is this something that will stop trans people being banned from this website for no reason? lmk