4 ms·
Most of these point come down to: don't trust random shit from the internet and don't blindly pull it into your projects/env.
by boesboes 2y ago
Most of these point come down to: don't trust random shit from the internet and don't blindly pull it into your projects/env.
- Joker_vD 2y agoBut how can we be productive as programmers without blindly copypasting random stuff from the Internet? ...well, I guess if your project is mostly about its internal business logic, not interacting/integrating with the wide world via the loads of weird and poorly implemented protocols and points, then you could be. But is this where the money are?
- littlestymaar 2y agoThe open question being: who can you trust. (And the XY backdoor shows that the answer is not trivial at all).
- pg5 2y agoHow does one actually avoid this? e.g. Say your boss needs you to make a react native app - you start their default project, pull in a few Expo libraries for core functionality. At that point there are hundreds of third party libraries that are being pulled in that you can't realistically vet.
- taneq 2y agoAgreed. Next step, it'd be just great if most open source software (and presumably most non-OSS code, although that's harder to determine) didn't pull in half the internet as mostly pointless dependencies. While we're at it, it'd be sweet if major OSes like Windows and most Linux distros would move to a threat model of "machine is used by one or more users who each want to safely run untrusted code without risking their own files, safety or privacy" instead of the old "machine is shared by many users and our main concern is guarding them against each other" model.