11 ms·
As with all end products where you need safety, all the dependencies (3rd party or not) you use should be treated as your own code. All the dependencies should
by extheat 5y ago
As with all end products where you need safety, all the dependencies (3rd party or not) you use should be treated as your own code. All the dependencies should be committed to SCM and reviewed before you deploy something into production, without any “automatic version bumping” magic that a package manager ala npm would otherwise do.
- joebob42 5y agoSure, but the startup that does this is going to lose, because usually a given risky dependency isn't actually going to turn out to be malicious, and reviewing all foreign dependencies as if they were your own code is wildly time consuming.