My main problem with this is that they punted the integrity check work down the line.
If this had been implemented as something akin to the integrity HTML attribute, e.g.:
express = require(
'https://my_local_repo.tld/express/current/4.17.1',
'sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC'
)
It would be vastly superior. I'd go so far as to
require it without an additional --unsafe-import type flag.
However, I think they did not do this because the import of dependencies then comes into question. IMO this feature should not have been added until developers could guarantee the expected integrity hash matches.
We've seen time and again what will happen now is hundreds of blog posts talking about this new feature, none of which will mention the integrity hashing functionality (because it's not there). When it does eventually get added, those posts will be the most popular anyone can find, and thus new users will end up using those eventually-wrong posts and implementing things in a less-secure way.
Huge disservice to the developer community.
If this had been implemented as something akin to the integrity HTML attribute, e.g.:
It would be vastly superior. I'd go so far as to require it without an additional --unsafe-import type flag.However, I think they did not do this because the import of dependencies then comes into question. IMO this feature should not have been added until developers could guarantee the expected integrity hash matches. We've seen time and again what will happen now is hundreds of blog posts talking about this new feature, none of which will mention the integrity hashing functionality (because it's not there). When it does eventually get added, those posts will be the most popular anyone can find, and thus new users will end up using those eventually-wrong posts and implementing things in a less-secure way.
Huge disservice to the developer community.