3 ms·

Who's reviewing the software package's dependencies?

• rndhouse 5y ago
  Each dependency of a software package would have its own separate set of reviews. Anyone can produce a review using Vouch. Official reviews will also be published in the future.
  • throwaway984393 5y ago
    So every version of every dependency of every package needs a review? It only takes one version of one dependency of any software package to be compromised by supply chain.
    • rndhouse 5y ago
      Each developer may choose to minimize the software dependency attack surface to a different degree. Perhaps they would trust a package published by Google without a review. But would require a review before using a package from an indie developer. Incremental decreses in the attck surface are valuable.