2 ms·
STOP AUTOMATICALLY DOWNLOADING CODE FROM THE INTERNET AND INCLUDING IT IN YOUR PRODUCT AS PART OF YOUR BUILD CHAIN why do I need to say this out loud?
by taneq 4y ago
STOP AUTOMATICALLY DOWNLOADING CODE FROM THE INTERNET AND INCLUDING IT IN YOUR PRODUCT AS PART OF YOUR BUILD CHAIN why do I need to say this out loud?
- miohtama 4y agoThese packages are not part of any build chain. Please see my earlier comment here https://news.ycombinator.com/item?id=34390100 https://news.ycombinator.com/item?id=34390100
- cozzyd 4y agoWell all it takes is a typo in requirements.txt?
- IshKebab 4y agoBecause for most people that's a stupid thing to say. Supply chain attacks are very rare still (especially ones that aren't just typo squatting), and auditing all dependencies (which is I assume what you meant) is ridiculously time consuming and unreliable. This small problem can 90% be solved through tool support, automated scanning and library sandboxing (which admittedly is not really supported by any languages yet - at least not without a lot of hoop jumping).