3 ms·
If this continues into the long-term without solution, I suspect paid package repos will start making an appearance, whereby only vetted versions of components
by anankaie 4y ago
If this continues into the long-term without solution, I suspect paid package repos will start making an appearance, whereby only vetted versions of components are available.
At least one big company already maintains internal clones of repos with registration of every version of every component used (I know this through personal experience) and I have no doubts the others are doing the same, especially if they are into cloud or government contracts.
- leaflets2 4y agoWhat about urgent security vulnerabilities in such components? Do these companies have people on-call who can security review urgent security fixes in the components? Or how does it work (say, Log4j and the fixes need to get reviewed urgently, and let's pretend the language wasn't Java but a language that fewer people could understand?)