4 ms·
Yes 'free' means 'the little people work on that'. There's no real way to secure finegrained node.js or python etc deps, since you have no clue if the original
by fivelessminutes 5y ago
Yes 'free' means 'the little people work on that'.
There's no real way to secure finegrained node.js or python etc deps, since you have no clue if the original author who signs his sources should be trusted, or was malicious from the start and just biding his time, let alone everyone who contributed to every package.
What would help is independent audits and where needed help with hardening like fuzzing and asan / valgrind / static analysis. Just an extra security-minded eye on patches in realtime would be a big help (and maybe would have found the logging bug at hand).
- tommek4077 5y agoThose audits are your duty. We've did this in programming a long time until recently the JavaScript craze took over.
- fivelessminutes 5y agoFOSS programmers owe you nothing, please read the license. You can keep dreaming otherwise and enjoy a steady stream of security problems from your leeching.
- tommek4077 5y agoI hope you are answering the parent. Because rhis is exactly what I said. You as a user of any foreign library have to look through it. You can't trust code you didn't write. That is also one of the reasons why in the past so many parts where reinvented. Those guys where not stupid, but why on eaeth would you risk the security of your work just to not write the login process yourself? And then some smarty pants came and told you this is all unnecessary and it is "best practice" to just include some library, package or whatever it is called nowadays.
- CRConrad 5y agoYour "your" was unclear: I also at first read it as "your, the FOSS devevlopers', problem".