3 ms·
It's just an absurd idea that your typical, average "modern JS" devs using React + Redux/Next.js (with a truckload of other deps), for example (as is pretty com
by Culonavirus 2y ago
It's just an absurd idea that your typical, average "modern JS" devs using React + Redux/Next.js (with a truckload of other deps), for example (as is pretty common these days), will review (or wait for a review of or pay for reviews of) the dep tree. People have enough on their plate, I'm willing to put my life on a bet that 90% of JS devs don't review their deps. It's preposterous to even suggest that. Just look into your node modules of these projects. This is done in maybe the top 10% most rich AND security minded businesses out there, mostly in the FAANG or the banking/govt sector. Individual devs or small teams? Forget it. Never worked at a place that did so or even heard of one.
It may be different with other languages and frameworks that may be moving more slowly or the dep tree is much flatter, but JS moves fast, browsers change often, and the dep trees are massive. Bugfixes and small feature upgrades could easily change a truckload of dep code.
Then, as if it wasn't enough, I'm not even sure how would you review something like an Electron-based app... what, you're gonna review the entire Electron-Chromium-Node chain on top of all the mess mentioned above? Sure :D
- lrvick 2y agoI would double down on your claim and say 99.9% of JS devs don't review dependencies. Also 100 years ago almost zero doctors washed their hands. The majority of people in a profession doing something does not make it any less negligent. My customer base is almost exclusively companies in industries like Fintech where giving strangers the ability to push any code they want to production is undesirable. In one case, the customer has their own internal team review all dependencies -and- has my team review them, and only adds a dependency to the allow list that get a thumbs up from both.