3 ms·
> Carefully consider each dependency you use, and if you need it.... Avoid dependencies that have many dependencies of their own. Good luck with nodejs apps :-
by majkinetor 6y ago
> Carefully consider each dependency you use, and if you need it.... Avoid dependencies that have many dependencies of their own.
Good luck with nodejs apps :-)
"Carefully considered EACH dependency recursively" is not actionable advice (and nothing worst then tautology).
I rely on automatic tests and penetration tests.
The actionable advice is more like: Carefully consider if you need dependency. When you choose to use them, don't spend more then a dozen of minutes analyzing them internally but rely on automatic tests.
- grey-area 6y agoOr don’t use nodejs because of the culture of extensive dependencies it encourages.
- cjaybo 6y agoThis sounds awfully hand-wavy to me. What sort of tests do you write that take allow you to forego vetting dependencies yourself? You mention penetration tests here (?), are those really less time consuming and more effective than taking 30 minutes to review a library?
- majkinetor 6y agoYeah, they are. Recursive checking of libs as suggested doesn't take 30 minutes, or otherwise nobody would complain. And what if you missed something because nobody checks thoroughly the library code in 30 minutes - one will certainly obfuscate any malicious procedure. Also you can outsource the tests and its easy to do. Depending on the contract, they can even be held liable if you come to get owned via the method that should have been tested.