3 ms·
No offense to the people who built this, but sharing your username and password with random packages on the internet seems like a bad idea, especially for finan
by darth_avocado 6y ago
No offense to the people who built this, but sharing your username and password with random packages on the internet seems like a bad idea, especially for finance apps.
- thephyber 6y agoWorking at a cybersecurity *aaS company has both made me paranoid about 3rd party code that I pull and also made me realize that at some point paranoia is paralyzing and some amount of risk is necessary. Bad idea? Likely. Worth the squeeze? YMMV.
- aasasd 6y agoThe bad idea in this scheme is to not take a look at what the code does, considering these are open-source packages.
- thephyber 6y agoI agree, but that's not sufficient in an open source software supply chain. You also need to inspect the dependencies and you need to do this every time you pull any new versions.
- fulldecent2 6y agoSharing your username and password is considered "high security" nowadays whereas merely "standard security" would be installing a root kit or running shell code each time you want to install something.