3 ms·

When I started working with Scala, it really surprised me how the JVM world deals with dependencies (include an upstream jar directly in the project, as opposed

When I started working with Scala, it really surprised me how the JVM world deals with dependencies (include an upstream jar directly in the project, as opposed to the Linux distro model where you use your distributor packages so you have security and bug fixes). I'm a big fan of Dependency Check[1]. There are hosted services that can give you security scans, but if you don't have access to that (some have a cost) or you are maintaining an open source project, Dependency Check is mostly great (there are some issues every now and then with false positives, but the maintainers are great and responsive and they deal with reports very quickly). There are also plugins for several building tools (e.g. sbt for Scala projects). 1: https://owasp.org/www-project-dependency-check/ https://owasp.org/www-project-dependency-check/ EDIT: this may help answering the question "do I use log4j?", because transitive dependencies can be complicated!

oauea 5y ago
> include an upstream jar directly in the project, as opposed to the Linux distro model where you use your distributor packages so you have security and bug fixes good luck getting all your versions to be compatible if you do that. Oh, now your java app can only run on Ubuntu 16.04? But our customers use CentOS 7? Guess they're out of luck. > EDIT: this may help answering the question "do I use log4j?", because transitive dependencies can be complicated! Just run `mvn dependency:tree` or the gradle equivalent.
philipwhiuk 5y ago
Worth saying that dependency-check I'm pretty sure hadn't picked it up as of Friday. It takes a while to get to the NVD lists and with this bug you don't have that kind of time. It's good for preventing people adding known-insecure libraries though.