3 ms·

This is why I absolutely hate not pinning down versions/hashes. For example, with `cargo`, let’s say a library I require passes a security audit. However, beca

This is why I absolutely hate not pinning down versions/hashes. For example, with `cargo`, let’s say a library I require passes a security audit. However, because a library it requires, or one of its dependencies requires doesn’t pin down a specific version but instead just requires “latest” or “2.1.”, my security audit is for naught given that malware can slip in any time for 2.1.. That goes for testing too. I’ve tested my software etc, but sometime down the line a transitive dependency updates and adds a bug. Now my software that i haven’t changed, is broken. Software requirements without pinning is a code smell.

gpm 6y ago
With Cargo, the final binary (or artifact if you're building a .so/.a/.dylib/...) has a `Cargo.lock` file that pins every recursive and non-recursive dependency. If you audit the packages in that, you've audited every dependency that is used in your project, and they will not change unless you yourself explicitly tell them to.
- alfiedotwtf 6y ago
  Oh! TIL, thanks!
remram 6y ago
If your direct dependencies pin their dependencies, then you will definitely end with conflicting versions for your transitive dependencies. This might work in environments like Node, where each library having their own private versions of their dependencies is acceptable, and Rust/Cargo in some situations, but doesn't work in environments where only one version of a package can be present (e.g. Python) or you care about the total size of the dependencies. Also if you're auditing, wouldn't you audit all dependencies? What does it matter whether they are pinned by your direct dependencies, wouldn't you yourself pin down the transitive dependencies after auditing them?
- alfiedotwtf 6y ago
  > Also if you're auditing, wouldn't you audit all dependencies? What’s the point of a transitive dependency can pull the rug out from under your audio with a single update
  - remram 6y ago
    Don't update without auditing the new versions? I don't understand.

gpm 6y ago

With Cargo, the final binary (or artifact if you're building a .so/.a/.dylib/...) has a `Cargo.lock` file that pins every recursive and non-recursive dependency. If you audit the packages in that, you've audited every dependency that is used in your project, and they will not change unless you yourself explicitly tell them to.

alfiedotwtf 6y ago
Oh! TIL, thanks!

remram 6y ago

If your direct dependencies pin their dependencies, then you will definitely end with conflicting versions for your transitive dependencies. This might work in environments like Node, where each library having their own private versions of their dependencies is acceptable, and Rust/Cargo in some situations, but doesn't work in environments where only one version of a package can be present (e.g. Python) or you care about the total size of the dependencies. Also if you're auditing, wouldn't you audit all dependencies? What does it matter whether they are pinned by your direct dependencies, wouldn't you yourself pin down the transitive dependencies after auditing them?

alfiedotwtf 6y ago
> Also if you're auditing, wouldn't you audit all dependencies? What’s the point of a transitive dependency can pull the rug out from under your audio with a single update
- remram 6y ago
  Don't update without auditing the new versions? I don't understand.