4 ms·

I still find it mind boggling that businesses have build processes for their core properties that rely on pulling hugs swathes off third party code in from the

• gw99 4y ago
  It’s even scarier when you actually sit down and review some of the code you’ve been importing for years… It has resulted in a major thinking shift for me. Mostly initiated by a malicious nodejs package being quietly pulled in.
  • jrib 4y ago
    Is there a language ecosystem you prefer now?
    • gw99 4y ago
      I mostly write stuff in Go with no imports at all now. It’s just that and stock vim on macOS is my entire stack. I am fortunate that my own contributions only require that.
• wongarsu 4y ago
  Had they written all the dependencies themselves, would they have been as secure and robust? The tradeoff isn't simple, and will be different for each company. I think everyone can point at a couple of components that are complex and massively benefit from the work poured into them and the large install base finding all the edge cases. Equally everyone can name a couple of dependencies that anyone could rewrite in a couple hours, and maybe even improve on the way.
  • taneq 4y ago
    Maybe, maybe not, but they certainly wouldn’t have included as many widespread, well known vulnerabilities with exploits already in the wild. And even if the imported code was perfect at the time it was imported, pulling in changes automatically is still an attack vector that you could drive a fleet of buses through. Note that I’m not saying “never use libraries”, which your points seem mainly aimed at. Code reuse is great! I’m just not sold on automatic, unmonitored updates to libraries.