3 ms·
This problem exists with all shared code. Shared code, shared fate. You hope that with more eyes on a library, it'll be more secure. It may also mean vulnerabi
by pradn 3y ago
This problem exists with all shared code. Shared code, shared fate.
You hope that with more eyes on a library, it'll be more secure. It may also mean vulnerabilities have a higher blast radius. You have to choose where you want to lie on the balance.
Spectre and Log4J - problems on widely deployed tech (Intel CPUs, Java services).
- steve_adams_86 3y agoVery good point at the end; the lower level you go, the broader (and likely more severe) your vulnerabilities will be. I suppose in this case my concerns aren't warranted, or at least not worth placing before more immediate and obvious concerns. i.e., I could write shitty code a lot more easily than Unison could compromise their language and infrastructure.