4 ms·
> self hosted dependencies/packages. Why? If your lockfile specifies and enforces the hash of the package, you don't need to self-host it - the lockfile will t
by roblabla 5y ago
> self hosted dependencies/packages.
Why? If your lockfile specifies and enforces the hash of the package, you don't need to self-host it - the lockfile will take care of detecting supply chain compromises that swaps a package with another.
100% agree on audits being necessary.
- delusional 5y agoYou're still downloading random stuff from the internet. A vulnerability in your package manager could let an attacker bypass the hash check, or they could discover a hash collision. If you really want to be sure, having the exact bits on a system you control seems like the right move.
- charcircuit 5y agoSelf hosting protects against attacks against the availability of your supply chain.