3 ms·
Do you have a reference to such statistics? I'd love to use them as yet another reason against vendoring dependencies when I talk to colleagues.
by cassianoleal 8y ago
Do you have a reference to such statistics? I'd love to use them as yet another reason against vendoring dependencies when I talk to colleagues.
- viraptor 8y agohttps://blog.acolyer.org/2017/04/03/a-study-of-security-vulnerabilities-on-docker-hub/ https://blog.acolyer.org/2017/04/03/a-study-of-security-vuln... Cautiously posting that link, because I'm not against vendoring. You just need a process around keeping your dependencies up to date / refreshed automatically. The ability to vendor is one thing, how you use it is another.
- cassianoleal 8y agoThanks! I agree with your statement, but what I usually see in real life is that once dependencies are vendored in they never change.
- eeZah7Ux 8y ago> You just need a process around keeping your dependencies up to date / refreshed automatically That's what dynamic linking and Linux distributions are for.