3 ms·
Yeah I agree except I don’t understand what the point of the tweet was. Whether you have 1000 deps or 10 deps, the problem is about security, not dep count. Who
by linkmotif 8y ago
Yeah I agree except I don’t understand what the point of the tweet was. Whether you have 1000 deps or 10 deps, the problem is about security, not dep count. Who’s going to carefully audit 10 deps when they’re transitive? More than would audit 1000, but not many more. Having few deps does not appear to be the solution to dependency security.
- VonGallifrey 8y ago> Who’s going to carefully audit 10 deps when they’re transitive? I do. That is why I don't have many deps in general. Transitive or not. With only a handful of dependencies that are from trusted sources and that are audited by me I can be sure that they are safe. With 1000+ dependencies that are from as many random sources you can not do the same. Having 10 dependencies is drastically different from a security aspect then 1000+.