3 ms·
Using a blessed supply chain is not as stupid as it sounds. We do it at work so that every dependency we take is scanned.
by phoehne 3y ago
Using a blessed supply chain is not as stupid as it sounds. We do it at work so that every dependency we take is scanned.
- pipo234 3y agoInteresting. Is the blessing done by you, someone in your team, someone in another team, someone in another company, someone in government? Is the blessed supply chain comparable (not in volume, but in features, ease of use) to NPM or pip ecosystem? What do you do when you need the feature that isn't in the blessed set?
- phoehne 3y agoIt's done by another team. It's use is generally comparable to NPM and pip. In fact we use pip, but we pull from our servers instead of public. A lot of the scanning is automated and takes care of problems I've actually run into, like virus laden files. if something is not available, we don't use it. Because the cost of violating that policy is worse than having to find another solution.
- c0pium 3y agoOne useful side benefit of using a private package repo is telemetry. If every dev and CI/CD machine comes with your private pypi, and you want to know where some bad version was used, you can just check the logs as opposed to playing scanner roulette. Even if you did no scanning and literally just proxies public pypi, this would make it worth it.