4 ms·
But that's how trust works. If you don't trust them to pull in safe dependencies, then you don't really trust them.
by jlarocco 4y ago
But that's how trust works. If you don't trust them to pull in safe dependencies, then you don't really trust them.
- warkdarrior 4y agoThere are various degrees of trust. One may trust a package maintainer to write correct, well-designed code and to maintain it. But should one trust that package maintainer to have solid security standards in their code repo, their CI/CD, and their distribution mechanism?