> Do you audit the HUGE source code of the most vulnerable application you use, your web browser? It's a huge moving target with insane complexity. Didn't thin

> Do you audit the HUGE source code of the most vulnerable application you use, your web browser? It's a huge moving target with insane complexity. Didn't think so. No, I do not. Relevance? > Do you audit the source code of the compilers used to build your CPU? No, I do not. Relevance? > Instead of avoiding dependencies, I never said anything about "avoiding dependencies". Are you in the wrong discussion? > dependencies should be locked for a release cycle and audited with automated tools to instill confidence. Personal preference, open to debate.