4 ms·
How do you currently feel about attaching the experience to install or when restoring packages? Various ecosystems do this and some get flak for it because of h
by thenerdhead 4y ago
How do you currently feel about attaching the experience to install or when restoring packages? Various ecosystems do this and some get flak for it because of how many transitive dependencies and known vulnerabilities in comparison to others. I'm mostly curious because I'm working on a similar proposal here:
https://github.com/NuGet/Home/pull/11549 https://github.com/NuGet/Home/pull/11549
There's definitely a fine balance of noise, but how do you feel about it?
- woodruffw 4y agoIMO, the experience in ecosystems like npm has shown that attaching auditing directly to package management steps causes security fatigue: users who are trying to get something done are suddenly burdened with the potential security repercussions of their action, which frazzles them and causes them to mis-value the audit results. The worst outcome is the one you see in pretty much every nontrivial JS stack: dozens of “critical” vulnerabilities reported without user interaction, all ignored because the developer has learned that “critical” really means “I can’t silence this warning that something bad might happen in a specific set of circumstances.” When you make auditing opt-in (like we intend for `pip audit`) even “noisy” results do not cause as much fatigue, since the user has explicitly asked for them.