Nobody is forcing people to be employees of startups. They choose to do it of their own free will. If they think they can generate immense value from their own ideas they are free to go try to do that. Hiring people to do a job for a wage they agree to isn’t swindling.
It’s difficult to determine which individuals are involved and even if you manage to do that they almost certainly live in countries without extradition.
Let’s say you’re a democrat (or republican, w/e) who lives in a district that’s 50-50 dem/rep. Then maps get redrawn so your district is 80-20. Is your vote worth the same as it was before? Is it a good or bad thing that only ~10% of the population’s vote matters?
Rejecting any packages newer than X days is one nice control, but ultimately it'd be way better to maintain an allowlist of which packages are allowed to run scripts.
Unfortunately npm is friggen awful at this...
You can use --ignore-scripts=true to disable all scripts, but inevitably, some packages will absolutely need to run scripts. There's no way to allowlist specific scripts to run, while blocking all others.
There are third-party npm packages that you can install, like @lavamoat/allow-scripts, but to use these you need to use an entirely different command like `npm setup` instead of the `npm install` everyone is familiar with.
This is just awful in so many ways, and it'd be so easy for npm to fix.
depends, if you don’t clean up the logs and monitor that cleanup will it eventually hit the p&l? eg if you fail compliance audits and lose customers over it? then yes. it still eventually comes back to the p&l.
This example feels more like a bug in the law itself that should be corrected. If this behavior is acceptable then it should be legal so we can avoid everyone the hassle in the first place. I bet AI would be great at finding and fixing these bugs.