I didn't say that "I don't whitelist my deps." I said I don't need to manually verify every tiny thing that I whitelist. If you actually knew what you what you

I didn't say that "I don't whitelist my deps." I said I don't need to manually verify every tiny thing that I whitelist. If you actually knew what you what you were talking about, you would know that you can't specify a dependency in a Maven POM without specifying a version, so everything is effectively version pinned and doesn't magically change unless you do it explictly. And you can't change an artifact after it has been released; you have to issue a new release with different coordinates. These are features of Maven that npm is missing that would make it vastly more secure than it is now. And fat fingering a pom is different, because it requires many more mistakes to download some other software package than the one intended. That's what this discussion is about right? That it's absurdly easy to download the wrong package on npm but not other package managers, because npm is an insecure package manager.