3 ms·
Well the problem is exactly what I wrote in my original post: if you pull malware into your program as a transitive dependency, then you ship malware to your us
by palata 2y ago
Well the problem is exactly what I wrote in my original post: if you pull malware into your program as a transitive dependency, then you ship malware to your users.
You should care about not shipping malware to your users, I don't know how to put it differently.
- pdimitar 2y agoWe all know the dangers, dude. It's always a ROI and other analyses: stakeholders don't care much about malware in transitive dependencies, they want feature X within timeline Y. Do I like it? No, I hate it with all my heart, but that's the reality we live in. I am not paid to just tinker with the computer; I am paid to deliver stuff, within various deadlines, and of certain quality and that's not the highest possible, otherwise I'd thoroughly use fuzzers and fiddle with property tests for months, if not years.