3 ms·
> On the other hand, it also means that any bugs in the dependencies are baked into each application, and fixing those bugs (which may be critical security issu
by traceroute66 5y ago
> On the other hand, it also means that any bugs in the dependencies are baked into each application, and fixing those bugs (which may be critical security issues) requires rebuilding all the downstream code.
I'm afraid I don't buy that argument at all.
Because Python is either the same or worse.
You've got the potential bugs in the Python code itself, and then the potential bugs in the random Python dependencies. You've got a whole stack of potential bugs there.
P.S. What's that nonsense about "closed-source" Go binaries ? If its an open-source project then its open-source until its compiled ! If the code's on Github then you can clone it and do as you please if you're not happy with the author's Go code.
- kortilla 5y ago> Because Python is either the same or worse. No, you update a python library and it works for everything importing it. The point is that you can fix vulnerabilities in unmaintained apps with a simple update if the vulnerabilities are just in dependencies. > P.S. What's that nonsense about "closed-source" Go binaries ? The discussion is about passing around binaries and nothing else.
- koolba 5y agoIn practice the apps that don’t publish updated dependency lists are also the ones that end up breaking by when you do update their dependencies. It only works in the simplest of patch versions.