3 ms·

Melt your computer with compilation? A Node program? More to the point, did you audit Tensorflow? If no, then what's your point to begin with? If yes, what mad

by efdee 6y ago

Melt your computer with compilation? A Node program? More to the point, did you audit Tensorflow? If no, then what's your point to begin with? If yes, what made you conclude that auditing Tensorflow is doable, but usually simple NPM modules are "un-auditable"?

wizzwizz4 6y ago
I didn't audit Tensorflow. But I don't install Tensorflow programs, anyway, because I don't have the resources. The point isn't auditing, though; it's auditability. If it's auditable, then somebody's probably done it – but if it's not, you can't rely on just a spot check of a few dice-picked dependencies.
- efdee 6y ago
  And what about these NPM modules is not auditable?
  - wizzwizz4 6y ago
    There are hundreds of them, and they are very large, and many have no clear purpose, and they keep getting new versions that change seemingly nothing, but actually change a lot.