4 ms·
It’s similarly problematic but on a somewhat smaller scale and with fewer levels of nested dependencies.
by snazz 3y ago
It’s similarly problematic but on a somewhat smaller scale and with fewer levels of nested dependencies.
- eacapeisfutuile 3y agoI’m not sure this would be smaller scale? At least probably too early to tell?
- snazz 3y agoI just mean fewer total packages and fewer maintainers. Linux libraries and packages don’t have the culture of making a package out of a single small function and importing it everywhere, which is part of the reason why NPM is a good case study in opportunities for supply chain attacks.
- eacapeisfutuile 3y agoYes but the distribution likely depends on it, making it wider spread even without the middleman dependencies.