Hacker News Reader

This is why it's important to use containers for development - or at least SELinux on your development host machine.

Simply restrict file access of npm to its cache folders, so it cannot access your other user configuration files.

Use additionally a host firewall like opensnitch to block npm from any other host than npmjs.com.

This should be the default.

On Linux, packages should provide the SELiunx (or whatever) rules they need, and the user should accept them or not install the package (just like permissions on Android/iOS apps).

On Windows, the application could be sandboxed to its folder in `Program Files` and `%APPDATA%`.

Being secure by default should be the norm. When its not, you can tell users "you should do this" all you want, they won't do it.

Completely agree with you, selinux would be much much nicer if configuration and setup would be easier and streamlined with downstream packages. The current "GUI" is basically a configuration editor that nobody understands. Maybe it's time to improve it?

Reply on news.ycombinator.com