4 ms·
It’s one side of the coin. The other is, to do anything at all of practical use in 98% of jobs, day 1 is installing a tonne of OS stuff. It’s not practical to
by rich_sasha 5y ago
It’s one side of the coin.
The other is, to do anything at all of practical use in 98% of jobs, day 1 is installing a tonne of OS stuff.
It’s not practical to expect pretty much every dev to inspect 100% of that, even if that’s what they implicitly agree to do in the license.
- pc86 5y agoWe're not talking about "a ton of OS stuff," we're talking about NPM packages. If you have your package manager set up in a way that allows it to automatically upgrade/break your code, that's 100% on you.
- rich_sasha 5y agoI have a medium-sized data science project in Python. Nothing crazy. It's 180 packages, apparently, and 2.9M lines of code (whitespace, comments and all). Charitably let's call it 1m SLOC. Seriously, you expect anyone to audit all this? It's basically impossible for any solo dev / small org, and as I say, it's not even a big project. A vulnerability is like half a line, or sometimes a typo. Clearly, very different proposal for a large org, but even then, no small task.