Security News
Fluent Assertions Faces Backlash After Abandoning Open Source Licensing
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
Security News
Sarah Gooding
July 1, 2024
Leaders in the JavaScript community have launched a new initiative called e18e, where members are connecting and collaborating on performance resources. e18e, a numerical contraction for “ecosystem performance,” is aimed at speeding up the JavaScript ecosystem for a faster web, one package at a time.
e18e is launching with three areas of focus, building on existing performance projects that are already underway:
The initiative is addressing a systemic problem where technical debt has accumulated through the use of outdated utilities, poorly maintained and inefficient libraries, and the proliferation of transitive dependencies. One of the contributing factors is that there’s nearly zero cost to adding dependencies, which is a security concern as this creates a wider attack surface.
The e18e Discord server is the hub for activity on this initiative and anyone can join. It’s a friendly place where people can ask questions about improving performance and participants will share tools and tips.
The project reports that so far the Discord has facilitated non-stop discussions about how to improve packages' performance where maintainers are connecting and helping each other to send PRs to widely used libraries.
If interacting on Discord isn’t your jam, the group has also enabled discussions in the e18e GitHub repo to allow participants to engage in RFC-like discussions with threads. There’s a Q&A category where developers can ask for advice on performance-related topics.
The group is also very active on the e18e X account, featuring package performance optimization successes. One developer recently submitted a PR to the normalize-package-data package to use three fewer dependencies, after auditing using a simple methodology:
This is a major win, because normalize-package-data receives more than 40 million weekly downloads on npm. The PR enables it to remove extra dependencies by switching to native code available in Node.
The e18e project is gaining momentum and has so far received positive feedback as participants make strides to clean up bloat and reduce complexity across the ecosystem.
So far, e18e is having a lot of success helping developers move to reliable, actively maintained packages, introducing more lightweight alternatives to common libraries when fewer features are needed, and speeding up and optimizing widely used packages.
If you’re not sure where to get started, the e18e website lists a number of resources and tools for auditing dependencies and finding alternatives that are high quality minimal libraries. Collaborate with other like-minded performance enthusiasts by joining the the e18e Discord Server, connecting with members on GitHub, and following the initiative on X.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
Research
Security News
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
Security News
The UK is proposing a bold ban on ransomware payments by public entities to disrupt cybercrime, protect critical services, and lead global cybersecurity efforts.