4 ms·
Conceptually you could do that, if you were willing to only use dependencies from people you trusted that closely. That can only be a very, very tiny minority o
by CamouflagedKiwi 6y ago
Conceptually you could do that, if you were willing to only use dependencies from people you trusted that closely. That can only be a very, very tiny minority of people using Maven.
- chrisseaton 6y ago> if you were willing to only use dependencies from people you trusted that closely No that's what makes it a network. There's a transitive closure, so you can also use dependencies from someone trusted by someone you trust, or by someone trusted by someone trusted by someone you trust, and so on.
- jandrese 6y agoBut then it only takes one person trusting a bad guy to bring down the network.