3 ms·

But you can read the dependency list or even the code and decide whether to use it or not?

• pjmlp 9y ago
  Not in the presence of binary dependencies. Also the amount of CVEs in FOSS projects show that even the process of code review for patches isn't enough.
  • mixedCase 9y ago
    You mean, in projects written in languages that are unsafe from beginning to end rather than in small blocks?
    • pjmlp 9y ago
      I agree, just stating that plain code review isn't enough. Those patches also come in small blocks.