3 ms·
Every time we include a dependency in an application, we give its maintainers commit privileges to production. Who do we trust?
by marcus_holmes 7y ago
Every time we include a dependency in an application, we give its maintainers commit privileges to production. Who do we trust?
- 0x0 7y agoAn open source SDK can at least be audited and locked to a particular version, with no hidden shenanigans.
- microcolonel 7y agoThat's only if you don't review the changes, and trace the entry points at least.