4 ms·
Great, one package down, 8000 more dependencies to go
by hsbauauvhabzb 3y ago
Great, one package down, 8000 more dependencies to go
- lrvick 3y agoInfluential packages like curl will help set the bar others will follow. We should absolutely celebrate and encourage supply chain integrity transparency writeups like this from maintainers.
- hsbauauvhabzb 3y agoWhile I respect curls efforts, ‘we’re secure, trust us’ is not a good precedent to set.
- cesarb 3y agoSome packages are more central than others. For instance, the basic container image for a popular Linux distribution has only around 150 packages (and yes, it includes curl, which counts as two packages because the library and the command are packaged separately). A text-only "server" install of that distribution probably adds another hundred or so (for things like kernel, firmware, bootloader, ssh daemon, and so on). Even a full desktop install of that distribution, with lots of extra junk installed on top, doesn't get anywhere near 8000 packages.
- hsbauauvhabzb 3y agoUntil you install a single node application, or consider all the applications running on the package developers system, or the systems of the developers who provide the packages installed on the developers systems. I imagine the total number of trusted packages would be substantially higher.