4 ms·
Yes but if that’s the sentiment how is this not as problematic as the npm ecosystem.
by eacapeisfutuile 3y ago
Yes but if that’s the sentiment how is this not as problematic as the npm ecosystem.
- snazz 3y agoIt’s similarly problematic but on a somewhat smaller scale and with fewer levels of nested dependencies.
- eacapeisfutuile 3y agoI’m not sure this would be smaller scale? At least probably too early to tell?
- snazz 3y agoI just mean fewer total packages and fewer maintainers. Linux libraries and packages don’t have the culture of making a package out of a single small function and importing it everywhere, which is part of the reason why NPM is a good case study in opportunities for supply chain attacks.
- eacapeisfutuile 3y agoYes but the distribution likely depends on it, making it wider spread even without the middleman dependencies.