cpuguy83
Joined 13 years ago
Karma
2,034
Submissions
958
Member since
Oct 9
[ my public key: https://keybase.io/cpuguy83; my proof: https://keybase.io/cpuguy83/sigs/MuEz1UU_zSo4UKnd094MCmzz00ECpwuyAEYaDzBwZQY ]
View on Hacker NewsJoined 13 years ago
No one is saying the merger is illegal, just that it probably shouldn't be allowed.
In go, vendoring dependencies just copies the deps out of the module system into the local tree and it's managed the same as not vendoring. It won't even build of the go.mod has changed without also updating the vendor tree.
for the non technical folks: imagine there was a password that if you guess it, you can impersonate *any website on the internet*
now imagine the password is literally the number 4I'm not replying here to say one is better than than the other (npm has obviously had its share of problems) but rather to combat claims that curl|bash is somehow safer, it absolutely is not, in fact it's all the bad stuff about npm without the pretense of being potentially safe.