3 ms·
> It feels like it has a small attack surface, yet we use over 1700 packages. We only have 49 direct dependencies, so the vast majority of these are dependencie
by canadev 8y ago
> It feels like it has a small attack surface, yet we use over 1700 packages. We only have 49 direct dependencies, so the vast majority of these are dependencies of dependencies of dependencies etc etc. The web app itself doesn't use a lot of third party code, so most of these packages are part of the build system.
Wow. Small attack surface with 1700 dependencies. What a hard concept to swallow.
- blattimwind 8y ago"We only have 49 direct dependencies"
- randallsquared 8y agoYeah, I work in a bunch of node.js codebases, and 49 deps seems pretty high, unless they're including development environment deps.
- untog 8y agoPresumably they are, since he talks about the possibility of developer machines being attacked.
- randallsquared 8y agoWell, regular dependencies get installed on developer machines as well, so I'm not sure that follows.
- untog 8y agoWell why wouldn't he be including them in a conversation that includes developer machines?
- mcguire 8y agoDid you look at the application? Image manipulation on the client.
- jaffathecake 8y agoAlmost exclusively build stuff https://github.com/GoogleChromeLabs/squoosh/blob/master/package.json#L17 https://github.com/GoogleChromeLabs/squoosh/blob/master/pack...