5 ms·
if you're dealing with money, you shouldn't install any dependency unless you run a security check. you should never update a dependency unless you run a secur
by PunchTornado 7y ago
if you're dealing with money, you shouldn't install any dependency unless you run a security check.
you should never update a dependency unless you run a security check.
this isn't npm's fault.
- cortesoft 7y agoYeah, but it is so common in the NPM world that no one batted an eye when it was added.
- detaro 7y agoWhat does "run a security check" entail?
- acdha 7y agoI get where you’re coming from, but doesn’t that mean you need at least one full time security auditor just to keep pace? Node projects seem to pretty quickly hit hundreds or thousands of dependencies, which means updates happen most days.
- siriusfeynman 7y ago> But doesn’t that mean you need at least one full time security auditor just to keep pace Crazy idea - maybe you shouldn't be writing financial software if you're not going to audit the code that you're using