3 ms·
One simple example was that I couldn’t install dependencies from public registries such npmjs (npm) or pypi (pip). It took an approval process for an internal t
by webo 4y ago
One simple example was that I couldn’t install dependencies from public registries such npmjs (npm) or pypi (pip). It took an approval process for an internal team to review and clone packages onto Google’s internal registry.
On the other hand, things like deployment and monitoring were so trivial and magic.
This was circa 2015.
- ahoka 4y agoThat's kind of standard at big companies. Even at a small scale, it is beneficial to mirror every external dependency.
- shric 4y agoThe review part is the pain point far rather than the mirroring.
- johannes1234321 4y agoIt is a pain point, but relevant for legal liability and tracking security concerns, else you quickly have wild west where it's unclear what kind of problems affect which team and how
- wnoise 4y agoGiven supply chain attacks, that seems not only reasonable, but essential.