3 ms·
Number of dependencies isn't exactly arbitrary... If you have one huge dep it's easier to keep track you're on the latest update, also it's much less likely yo
by pixl97 2y ago
Number of dependencies isn't exactly arbitrary...
If you have one huge dep it's easier to keep track you're on the latest update, also it's much less likely you'll fat finger it and import something typosquatting.
Also if you're in enterprise you'll have less 100 page SBOM reports.
- MeetingsBrowser 2y agoWhat is more likely to be vulnerable, a 100k LoC project developed by ten people, or ten 10k LoC single maintainer projects. Keeping track of the latest version is trivial with cargo.
- pixl97 2y agoI work in SCA/SBOM. >What is more likely to be vulnerable, At the end of the day you are at much higher risks of one of those 10 packages getting owned by some external party and suddenly the next version is pulling a bitcoin miner, or something that steals everything it can from your CI/CD, or does a take over on your customers. And it's never 10 (well at least for JS), it's hundreds, or if you're team is insane, thousands.
- shwouchk 2y agoUnlike my sibling commment, i don’t work in SBOM, but if you consider social dynamics and what trust means, it should be pretty obvious that trusting in a group of 10 strangers is much less risky than trusting in 10 separate strangers. consider the probabilities