3 ms·
You have to have this trust with any software you're using. Is not feasible to inspect source and install from source every package/library you use. Any of them
by ivanjermakov 3y ago
You have to have this trust with any software you're using. Is not feasible to inspect source and install from source every package/library you use. Any of them can hypothetically run rm rf and include it even in a minor update.
- subtra3t 3y agoBut that risk is relatively small when you're using 2-3 packages that are very popular compared to 200-300 packages, most of which will be esoteric one liners.
- ivanjermakov 3y agoTrue, but only if these popular packages treat their own dependencies cautiously.