3 ms·
You're not the only one! This is why I strongly prefer languages with a comprehensive standard library. I trust my Python/golang/dotnet/whatever install, so th
by seabrookmx 3y ago
You're not the only one!
This is why I strongly prefer languages with a comprehensive standard library. I trust my Python/golang/dotnet/whatever install, so the number of third party packages I need to pull in is much smaller and more easily audited.
- mooreds 3y agoWhat is your audit schedule/process?
- seabrookmx 3y agoWell it starts with a culture of taking responsibility when adding a dependency. We want people to look at child dependencies and just think more critically about them before checking in code. This is mostly to prevent bloat but sometimes we catch unmaintained packages or accidentally pulling in a random form rather than the community supported variant, for example. We also run SAST in our gitlab pipelines and include reviewing the output as part of the code review and release process so that we can catch CVE's that may not have been known if when we first installed a package.
- TZubiri 3y agoI build python servers. I've replaced most of the dependencies with just standard library code. Removed Flask for http.server Removed requests for urllib Removed requirements.txt Removed pip Life is good
- maxerickson 3y agoI use urllib.request to avoid having a dependency in little scripts, but I can't say I think that requests is a big supply chain risk.
- benglish11 3y agoIt may not be the request package itself but a sub dependency. It only has a few from looking at the repo but something like flask can have a lot (especially with the plugins) and that’s a mainstream and well supported library