Npm 1.0 released (with global and local installation space) (blog.nodejs.org) 45 points by bauchidgw 15y ago ↗ HN
[–] corbet 15y ago ↗ I assume that somebody knows what "npm" is? I have no clue and the linked page doesn't tell me. OTOH it's happy to tell me to feed curl output straight into a root shell, an idea that makes me just a wee bit nervous. [–] maratd 15y ago ↗ A package manager for nodejs. It is primarily used for development and testing. [–] trafficlight 15y ago ↗ You don't use it for production? Do you include modules locally in production? [–] FooBarWidget 15y ago ↗ The NPM authors explicitly draw the line between development and production. Their official stance is that NPM should be a development tool; in production modules should be installed through the native OS package manager. http://blog.nodejs.org/2011/04/04/development-environment/ (bottom) http://blog.nodejs.org/2011/04/06/npm-1-0-link/ ("Caveat: Not For Real Servers") [–] state_machine 15y ago ↗ Neither the command on the page, nor the script it downloads, use sudo (or su for that matter).Just invoking 'sh' really should not give you a root shell under normal circumstances.You can try running 'echo "whoami" | sh | grep root' to verify this yourself. [–] kcbanner 15y ago ↗ Exactly, and many users install node into ~/local so root privileges are never needed.
[–] maratd 15y ago ↗ A package manager for nodejs. It is primarily used for development and testing. [–] trafficlight 15y ago ↗ You don't use it for production? Do you include modules locally in production? [–] FooBarWidget 15y ago ↗ The NPM authors explicitly draw the line between development and production. Their official stance is that NPM should be a development tool; in production modules should be installed through the native OS package manager. http://blog.nodejs.org/2011/04/04/development-environment/ (bottom) http://blog.nodejs.org/2011/04/06/npm-1-0-link/ ("Caveat: Not For Real Servers")
[–] trafficlight 15y ago ↗ You don't use it for production? Do you include modules locally in production? [–] FooBarWidget 15y ago ↗ The NPM authors explicitly draw the line between development and production. Their official stance is that NPM should be a development tool; in production modules should be installed through the native OS package manager. http://blog.nodejs.org/2011/04/04/development-environment/ (bottom) http://blog.nodejs.org/2011/04/06/npm-1-0-link/ ("Caveat: Not For Real Servers")
[–] FooBarWidget 15y ago ↗ The NPM authors explicitly draw the line between development and production. Their official stance is that NPM should be a development tool; in production modules should be installed through the native OS package manager. http://blog.nodejs.org/2011/04/04/development-environment/ (bottom) http://blog.nodejs.org/2011/04/06/npm-1-0-link/ ("Caveat: Not For Real Servers")
[–] state_machine 15y ago ↗ Neither the command on the page, nor the script it downloads, use sudo (or su for that matter).Just invoking 'sh' really should not give you a root shell under normal circumstances.You can try running 'echo "whoami" | sh | grep root' to verify this yourself. [–] kcbanner 15y ago ↗ Exactly, and many users install node into ~/local so root privileges are never needed.
[–] kcbanner 15y ago ↗ Exactly, and many users install node into ~/local so root privileges are never needed.
6 comments
[ 3.3 ms ] story [ 24.1 ms ] threadJust invoking 'sh' really should not give you a root shell under normal circumstances.
You can try running 'echo "whoami" | sh | grep root' to verify this yourself.