3 ms·

Blame it on go dependency lists and similar. What do you even review when it's one of those? There's thousands of lines changed and they all point to commits o

by guappa 2y ago

Blame it on go dependency lists and similar. What do you even review when it's one of those? There's thousands of lines changed and they all point to commits on other repositories. You're essentially hoping it's fine.

lrvick 2y ago
Shipping code to production without evidence anyone credible has reviewed it at a minimum is negligence.
- guappa 2y ago
  You're claiming here that you do a review of all of your dependencies?
  - lrvick 2y ago
    For security critical projects, of course. I even reproducibly bootstrap my own compilers and interpreters.