3 ms·
No one (that I'm aware of) has managed to make a successful business of "curated" packages (interested to hear if there are any). You get companies doing thing
by raesene9 6y ago
No one (that I'm aware of) has managed to make a successful business of "curated" packages (interested to hear if there are any).
You get companies doing things like version checking and basic scans for malware, but that wouldn't catch issues like this.
My guess is that the volume of security review you'd need to do, for it to be usable by enough companies, is massive and a lot of the review would need to be manual.
Then as you add libraries you need to dedicate resources to reviewing every new release.
- verall 6y agoWhat is a Linux distro
- raesene9 6y agoAs far as I'm aware, distros are not doing security review of all the packages they include. I'd be pretty surprised to find out that they have the kind of resources needed to do code review of even a small percentage of their packages.
- jakelazaroff 6y agoMost packages don’t have 3 million weekly downloads, though. Surely Microsoft has the resources to review at least some of the most popular ones.
- raesene9 6y agoSo the challenge even for someone like MS is, how far down the line do they go. Do they do a one-time review, problem there is it won't catch new issues. Do they provide PRs for fixing issues found, that's another level of complexity. If the library owners don't patch promptly, do MS fork the lib, if they do, will people move to their forked version? It's a complex area to say the least :) It'd be great to see more companies take it on but I have a feeling it'll be a long time before we see significant coverage of this kind of issue.
- jakelazaroff 6y agoIn this case, a one-time review might have sufficed; this bugfix was the first release in five years. But generally speaking, you're 100% right — and obviously, this little package is orders of magnitude less complex than e.g. React or Express.