3 ms·
Probably hard to do during nine-to-five, but personally commit to being a contributor on every dependency used. Like having mini contracts with every package,
by turtleyacht 1y ago
Probably hard to do during nine-to-five, but personally commit to being a contributor on every dependency used.
Like having mini contracts with every package, even if it's just to reproduce bugs, maintain a personal test suite, or to steer newcomers to resources.
Otherwise, we will always be in the dark about our dependencies, building our flying castles. (They float, but where's the foundation?)
Alternatively, there are open-source code scanners and bill-of-material security tools. Those could be added as triggered workflows in your projects, to run on each pull request.
As well, the author did rewrite dotenv's core features to replace it.
- vsgherzi 1y agoYeah that's not a bad suggestion, I should def be more involved in the ecosystem. To do that for every crates seems exhausting though... Any favorite suggestions for scanners or SBOM creation tools?
- turtleyacht 1y agoSnyk has a free tier, but their Github integration passes workflows green more often than not. If you run it yourself as a container, you get finer-grained control over what to do with error code 1 versus error code 2: a vulnerability in changed versions, versus a pipeline error. Sonar is free for open-source projects, but less package version security and more "use --ignore-scripts in npm," "don't be root in Docker container," and such.
- vsgherzi 1y agoNoted, I'll check it out! A shame so many are bound to github most of my workflow is tied to git on secured servers