> What's the point of a philosophy that is impossible to live up to. Nobody audits a substantial fraction of their dependencies. It's a choice to be ignorant o

> What's the point of a philosophy that is impossible to live up to. Nobody audits a substantial fraction of their dependencies. It's a choice to be ignorant of your dependencies, not a law of nature. The fact that most people don't audit code they depend upon is a problem to be fixed, unless the underlying code is fixed first.