3 ms·
This is a minor worry when the entire software ecosystem is based on “download any old shit off the Internet at run it”.
by ohgr 2y ago
This is a minor worry when the entire software ecosystem is based on “download any old shit off the Internet at run it”.
- sureIy 2y agoMy company went into full panic mode after this. 5 minutes later dependabot opens and auto merges a random patch from npm, but that's fine.
- TheRealPomax 2y agoSay what you want about dependabot, and people who allow it to auto-merge changes, but at least NPM releases are not mutable (... anymore, at least. NPM had to learn that one the hard way, but unlike github it actually learned something).