3 ms·
I think you would end up in a rabbit hole. Do you also review your all GNU/Linux libraries and dependencies? Probably not because you trust them. Thus I think w
by povils 7y ago
I think you would end up in a rabbit hole. Do you also review your all GNU/Linux libraries and dependencies? Probably not because you trust them. Thus I think we should be pragmatic and review only libraries which are created by unknown/untrusted creators.
- atoav 7y agoWell I think you should at least do two things: - avoid dependencies where you reasonably can. Less moving parts are usually good - just have a look at the dependencies of your dependencies - this might help you decide which one to trust
- marcus_holmes 7y agoOpen-source projects can and do change maintainers. Adding a dependency means you not only trust the maintainer now, but you also trust all future maintainers of the project. Dependencies are more dangerous (in this sense) because they compile into your application, so they can do anything they like to your customer data. A malicious tool could monitor your keystrokes and phone home, but it won't get installed on your production server. A further problem with npm dependencies is that they get told when they're operating in dev mode and when in production mode. So malicious code can hide itself during dev and test, and then only do the bad thing on the production server.
- progval 7y agoDebian packages are maintained (and quickly vetted) by a rather small group of people (who vet each other). npm packages can be published by anyone without review. On a somewhat related topic: https://drewdevault.com/2019/12/09/Developers-shouldnt-distribute.html https://drewdevault.com/2019/12/09/Developers-shouldnt-distr...