3 ms·
In the hypothetical above, you won’t have any way to know which libraries are actually being used unless you read through the source code. Many libraries will t
by markisus 2y ago
In the hypothetical above, you won’t have any way to know which libraries are actually being used unless you read through the source code. Many libraries will transitively include protobuf, but most functions will not call protobuf.
- bronson 2y agoAgreed. Even if you establish that it's not being used today, that doesn't mean that it will continue to be unused after the next few commits land. And, even though you might not see a way to call into the unused code, an attacker might find a way (XZ Utils).