3 ms·
We're not talking about "a ton of OS stuff," we're talking about NPM packages. If you have your package manager set up in a way that allows it to automatically
by pc86 5y ago
We're not talking about "a ton of OS stuff," we're talking about NPM packages.
If you have your package manager set up in a way that allows it to automatically upgrade/break your code, that's 100% on you.
- rich_sasha 5y agoI have a medium-sized data science project in Python. Nothing crazy. It's 180 packages, apparently, and 2.9M lines of code (whitespace, comments and all). Charitably let's call it 1m SLOC. Seriously, you expect anyone to audit all this? It's basically impossible for any solo dev / small org, and as I say, it's not even a big project. A vulnerability is like half a line, or sometimes a typo. Clearly, very different proposal for a large org, but even then, no small task.