4 ms·

People can be snarky about using 'untrusted code' but in 2023 this is the default for a lot of places and a majority of individual developers when the rubber me

People can be snarky about using 'untrusted code' but in 2023 this is the default for a lot of places and a majority of individual developers when the rubber meets the road. Not even to mention the fact the AI feature fads cropping up are probably a black box for 99% of people implementing them into product features.

krainboltgreene 3y ago
> in 2023 this is the default for a lot of places This is incredibly hyperbolic.
- 3-cheese-sundae 3y ago
  Are you sure? It's been accepted as common practice in my 15 year career so far, across multiple industries including automotive, finance, and marketing.
  - alexpotato 3y ago
    I agree with this. I have never seen a firm say "hey, we should dig down the dependency chain to ensure that EVERY SINGLE package we use is fully signed and from a trusted (for some degree of trusted) source" If anything it's more like "we are bumping Pandas versions and Pandas is famous for changing the output of functions from version to version and we have no specific tests to catch that. What should we do??"
    - nicce 3y ago
      Not to mention that we still use and trust many closed-source applications. I am even writing this on one (Safari).
  - lmm 3y ago
    When I worked in finance every dependency was checked and we had to know who the responsible vendor was, or have an internal owner in the case where we were using something as freeware (and we preferred to have a vendor contract even for open-source). We didn't dig much deeper than "who is it and what's their reputation", but we absolutely had a record of where each dependency was from and a name on the list.
    - mowse_winded 3y ago
      But then did you check every one of their dependencies?
      - lmm 3y ago
        We treated transitive dependencies the same as any other dependencies (i.e. they had to have an owner and be audited etc.). We didn't audit our suppliers' build toolchains or vendored dependencies, but would've considered them responsible if something malicious came in that way.

krainboltgreene 3y ago

> in 2023 this is the default for a lot of places This is incredibly hyperbolic.

3-cheese-sundae 3y ago
Are you sure? It's been accepted as common practice in my 15 year career so far, across multiple industries including automotive, finance, and marketing.
- alexpotato 3y ago
  I agree with this. I have never seen a firm say "hey, we should dig down the dependency chain to ensure that EVERY SINGLE package we use is fully signed and from a trusted (for some degree of trusted) source" If anything it's more like "we are bumping Pandas versions and Pandas is famous for changing the output of functions from version to version and we have no specific tests to catch that. What should we do??"
  - nicce 3y ago
    Not to mention that we still use and trust many closed-source applications. I am even writing this on one (Safari).
- lmm 3y ago
  When I worked in finance every dependency was checked and we had to know who the responsible vendor was, or have an internal owner in the case where we were using something as freeware (and we preferred to have a vendor contract even for open-source). We didn't dig much deeper than "who is it and what's their reputation", but we absolutely had a record of where each dependency was from and a name on the list.
  - mowse_winded 3y ago
    But then did you check every one of their dependencies?
    - lmm 3y ago
      We treated transitive dependencies the same as any other dependencies (i.e. they had to have an owner and be audited etc.). We didn't audit our suppliers' build toolchains or vendored dependencies, but would've considered them responsible if something malicious came in that way.