3 ms·
This is the scary part about dependency-heavy projects. Sure, you trust the developers of Rails, but what about that gem 5 levels down your dependency tree? May
by vlunkr 10y ago
This is the scary part about dependency-heavy projects. Sure, you trust the developers of Rails, but what about that gem 5 levels down your dependency tree? Maybe you've seen the name as you glance through your lockfile, but you don't know what it does, when it was last updated, who (if anyone) maintains it, how competent they are, or what processes they have in place to keep bugs out.
- ianlevesque 10y agohttps://github.com/rubysec/bundler-audit https://github.com/rubysec/bundler-audit
- Maskawanian 10y agoYeah, but that problem exists with all levels of software development. The best I've seen so far is signed packages in Linux. But even then you must trust someone.