3 ms·
The bad idea in this scheme is to not take a look at what the code does, considering these are open-source packages.
by aasasd 6y ago
The bad idea in this scheme is to not take a look at what the code does, considering these are open-source packages.
- thephyber 6y agoI agree, but that's not sufficient in an open source software supply chain. You also need to inspect the dependencies and you need to do this every time you pull any new versions.