3 ms·
This sounds awfully hand-wavy to me. What sort of tests do you write that take allow you to forego vetting dependencies yourself? You mention penetration tests
by cjaybo 6y ago
This sounds awfully hand-wavy to me. What sort of tests do you write that take allow you to forego vetting dependencies yourself?
You mention penetration tests here (?), are those really less time consuming and more effective than taking 30 minutes to review a library?
- majkinetor 6y agoYeah, they are. Recursive checking of libs as suggested doesn't take 30 minutes, or otherwise nobody would complain. And what if you missed something because nobody checks thoroughly the library code in 30 minutes - one will certainly obfuscate any malicious procedure. Also you can outsource the tests and its easy to do. Depending on the contract, they can even be held liable if you come to get owned via the method that should have been tested.