3 ms·
True enough... but you still don't know what the dependencies do. E.g., one added ads. Another added use tracking. This could even be legitimately in line with
by Beldin 6y ago
True enough... but you still don't know what the dependencies do. E.g., one added ads. Another added use tracking. This could even be legitimately in line with the dependency's purpose.
Unless you're manually vetting all the code, 400 dependencies means trusting a lot of third parties.
- hedora 6y agoTrusting a lot of third parties is almost as irresponsible as not bothering with checksumming, etc. See npm and pip for examples. I suspect cargo will have its share of incidents over time, unless it is somehow curated by a small group that tests and maintains the packages, but if it is, then it’s comparable to apt for c/c++.