3 ms·
So every version of every dependency of every package needs a review? It only takes one version of one dependency of any software package to be compromised by s
by throwaway984393 5y ago
So every version of every dependency of every package needs a review? It only takes one version of one dependency of any software package to be compromised by supply chain.
- rndhouse 5y agoEach developer may choose to minimize the software dependency attack surface to a different degree. Perhaps they would trust a package published by Google without a review. But would require a review before using a package from an indie developer. Incremental decreses in the attck surface are valuable.