3 ms·

Tangentially related: Many companies have auditing requirements for external dependencies, with increasing strictness for more sensitive domains. It would be

Tangentially related: Many companies have auditing requirements for external dependencies, with increasing strictness for more sensitive domains. It would be immensely helpful to distribute this effort. We could have a platform that pays top domain experts and security researchers for audits. Companies can get access to via a subscription model or by paying for specific dependencies. Vulnerabilities would also be reported and fixed, helping everyone, and companies benefit by having a trustworthy source for audits and save internal work. Ideally the platform would be successful enough to open up a good amount of audits publicly to benefit the whole community. Also related: cargo-crev [1] explores a concept for shared auditing and trust for Rust crates. [1] https://github.com/crev-dev/cargo-crev https://github.com/crev-dev/cargo-crev

rozab 6y ago
Either the bugs aren't reported to upstream and it remains vulnerable, or they are reported and get fixed, making paying to access the audit pointless. The first option would basically involve the platform maintaining a closed fork, which won't work with most licenses and would be terrible for the ecosystem.
- the_duke 6y ago
  I don't see the connection. As I said, many companies require a review/sign off for each dependency (version). Since they usually can't get them externally, they have do it internally. Enterprises also throw a lot of money at support contracts they never use, there is absolutely space for auditing expenses that give assurance and will be more thorough than any internal process.