2 ms·
It definitely does solve one problem. Like it or not, you can't be hit by supply chain attacks if you don't have a supply chain.
by achierius 1y ago
It definitely does solve one problem. Like it or not, you can't be hit by supply chain attacks if you don't have a supply chain.
- dgfitz 1y agoI mirror all deps locally and only build from the mirror. It isn’t an issue. C/C++ is my dayjob
- procaryote 1y agoat some point you could mirror a supply chain attack... xz was a pretty long game and only found by accident for example
- dgfitz 1y agoI’m sure I will.
- josephg 1y agoThis runs the risk of shipping C/C++ libraries with known vulnerabilities. How do you keep track of that? At least with npm / cargo / etc, updating dependencies is a single command away.