> The idea that say a startup has time to audit every line of every dependency is absurd. I kind of agree, but remember you are getting free software. Not a li

> The idea that say a startup has time to audit every line of every dependency is absurd. I kind of agree, but remember you are getting free software. Not a little, but a ton of free software and you feel like somebody should guarantee all works fine. Choices: - See what is going on in all your deps and waste a lot of time - Risk it and use the software without knowing what is doing - Pay somebody to guarantee that the software is not malicious