This - I've been very honest with my manager that I won't play "the game" in this organisation - I don't really have to, there is plenty for staff engineers to tackle to have a long career without the yoke of management.
1,035 karma · joined June 27, 2012
My current company I'm now on year 4, and 3rd year leading a team building an internal platform for the business - for me it is a dream role - management mostly stay out the way, strategy comes from top down but our team make all the decisions, and after a slow start it's now paying off with several teams using us and helping drive through real requirements, and not the imagined ones from a few execs.
This has lead to constant positive feedback from all of our 'customers' who would never have been able to consider running their own content delivery pipelines - we're solving their real problems. Regardless of any politics, this is what gives me the energy to turn up every day.
(Thinking about it, would that necessarily be a bad thing...)
They still need it still needs a Personal Access Tokens - but many organisations restrict them now, and even bypassing that, the PAT tokens are too broad in there permissions (github cli being one example)
Meanwhile I read the material and t absolutely feels like a cult - "R is fun" is like something they say to persuade themselves they are not in a cult
This is another huge pet peeve of mine is how hard it is to have a good container pipeline to build containers without running root - we tried some of the alternatives but they all had drawbacks - easiest is to just use GitHub Ubuntu images and hope for the best (although I recently saw some improvement in this area we want to investigate)
That's sort of the thing - all of these measures are just patches on the fundamental problem that npm has just become too unsafe
2FA isn't a solution to security, it's a solution to hinder and dissuade low-effort hackers from compromising accounts - it's still subject to social engineering (like spearphishing).
I tend to agree with your broader point - sandboxing will be the way to go, I've been having that very discussion today. we're also now enforcing CI pipelines with pinned dependencies (which we do with our helm charts, but npm by default will install with ^ semver and putting that on the developer to disable isn't good enough - the problem of course is that requires the OS vendors to agree on what is common.
This is a riff - not sure how possible this is, but it's not coming from nowhere, it's based on work I did 8 years back (https://github.com/takeoff-env/takeoff) - using a headless OS container image with a volume pointing to the source folder, run the install within the container (so far so good, this is any multi-stage docker build)
The key part would be to then copy the node_modules in the volume _data folder back to the host - this would of likely require the OS vendors to provide timely images with each release of their OS to handle binary dependencies, so is likely a non-starter for OSX.
SaaS products don't enforce good security - I've seen some internally that don't have MFA or EntraID integration because they simply don't have those as features (mostly legacy systems these days, but they still exist).
I'm also an open-source author (I have the most used bit.ly library on npm - and have had demands and requests too), and I'm the only person you can publicly see on our [company github](https://github.com/ikea) - there's reasons for this - but not every company is leeching, rather there is simply no other alternative.
Think sharing your electricity usage with a company selling power solutions at home, they could get agreements to access this data on behalf of people using essentially peer-to-peer API services.
Nobody: "Yay"
He makes no claim to what life was before the formation of the moon, but rather than the cataclysm of formation of the moon is what changed life on Earth - of course he wraps the whole idea up in his mysticism - but his 1950s writing on this was not far off what happened.
Sadly never got picked up, although we proved the concept could work - but it certainly had it's challenges.
"If you think about it - we're one misplaced negative sign, hallucinated by an LLM away from a disaster. At least multiply by zero won't crash things /s"