3 ms·
I read the GP post as saying that having fewer dependencies makes reviewing them easier, not that one need not review them?
by jen20 7y ago
I read the GP post as saying that having fewer dependencies makes reviewing them easier, not that one need not review them?
- danShumway 7y agoMy point being that "NPM is bad for security" is probably the wrong take to convince a software team to avoid the ecosystem. Instead, phrase it as, "well obviously we need to review our dependencies, so why use an ecosystem where that's hard?" Don't phrase it as a security problem, phrase it as a development time and overhead problem. Or better yet, let your team use NPM as long as they review the dependencies, and if your dependency tree is really a problem, your team will naturally become annoyed by the extra work and will avoid large dependencies on their own without a lot of extra prompting.