4 ms·
It's only impossibly hard to audit this kind of thing if you have an insanely large and deep tree of transitive dependencies in the first place. This seems to b
by Silhouette 9y ago
It's only impossibly hard to audit this kind of thing if you have an insanely large and deep tree of transitive dependencies in the first place. This seems to be a particularly bad problem in the JS world, for this and many other reasons, but most programming languages and their communities don't work that way. Auditing a small number of larger dependencies, when most of them are probably widely used and from reasonably trustworthy sources, is much more achievable.
- Shoothe 9y agoHa, what an excellent timing with another related story on top of the HN: https://news.ycombinator.com/item?id=16087024 https://news.ycombinator.com/item?id=16087024
- dmitriid 9y agoThe other languages have the same problem. It's only spread over different places. For example, JS doesn't have a standard library. Many languages do. So when JS downloads loads of transitive dependencies, many are there because there's no stdlib. Have you audited your C++, or Java, or Ruby, or... stdlib lately? Especially those that come preinstalled with your OS of choice? Same goes for anything that you download via Maven, or gems, or easy_install, or include as direct GitHub references in your Go code.
- Silhouette 9y agoThose standard libraries are typically widely used. In many cases, the source can be examined. In most cases, there's a large professional team at a reasonably reputable organisation responsible for maintaining them. In almost all cases, there are no transitive dependencies not managed by the same people. Once installed on your system, they generally don't change unless you actively change them. While there is some risk in any dependency (cf. Reflections on Trusting Trust) the level of risk is on an entirely different scale in this sort of situation compared to what much of the JS world does every day.
- dmitriid 9y ago> In many cases, the source can be examined. Have you examined them, though? ;) And yes, I was thinking about Reflections on Trusting Trust as well :) > In almost all cases, there are no transitive dependencies not managed by the same people. That's why I said the risk is spread very differently compared to JS :)
- rmrfrmrf 9y agoI also think that with tree shaking and last-mile minification being more common these days, auditing might not be as daunting as it seems.