3 ms·
I am paranoid about security of all those packages, so yes, even before just downloading, I check the authors, activity and read the source code. Not always – e
by nikitaga 6y ago
I am paranoid about security of all those packages, so yes, even before just downloading, I check the authors, activity and read the source code. Not always – e.g. I skip the source code if it's something big AND very reputable AND I decided that I need it such as scala/scala or facebook/react – but I do my best.
It's very annoying, it's not free, and it affects what kinds of libraries I use. My projects have fewer and smaller dependencies than typical because of these self imposed constraints.
On the upside, borrowing a pattern or a dozen lines of code instead of pulling a dependency that will remain 90% unused is really underrated. As is understanding how things work under the hood.
- jfoster 6y agoReact itself is big & reputable, but the dependency tree is massive and I doubt that it's getting fully vetted on an ongoing basis. Even if you vet it today, any given dependency can be updated to something else tomorrow. There are definitely some things in React's dependency tree that are a bit questionable if you are sensitive enough to any given problem, beyond just security. For example, packages where the license being used is contradictory between the package.json vs the LICENSE file or the full license terms are not expressed within these but are clarified in the README.md.
- overkalix 6y ago> My projects have fewer and smaller dependencies than typical Taking a look at your at your github projects and build.sbt... this is quite an understatement.
- nikitaga 6y agoHaha well tbh I just didn't feel the need for more deps in such libraries. It's a tougher choice in application code!