3 ms·
On Google scale you quite certainly want to do that. Not just for security, but for legal reasons. You really don't want to end up using for example AGPL licens
by jpalomaki 9y ago
On Google scale you quite certainly want to do that. Not just for security, but for legal reasons. You really don't want to end up using for example AGPL licensed stuff in wrong places and if you just blindly pull stuff with dependencies from package manager, this could easily happen.
- BeeOnRope 9y agoSure a legal audit is standard and usually much simpler than a full source audit for security, which has a complexity proportional to the project size.
- thanatropism 9y agoOne of the recent True Geordie podcasts features the "YouPorn Guy" who talks about finding it near impossible to get lawyers not on a retainer from Google to fight them.