32 ms·
Would be neat if the call graph could be asserted easily.. As you could not only validate what vulnerabilities you are / aren't exposed to, but also choose to b
by unshavedyak 8mo ago
Would be neat if the call graph could be asserted easily.. As you could not only validate what vulnerabilities you are / aren't exposed to, but also choose to blacklist some API calls as a form of mitigation. Ensuring you don't accidentally start using something that's proven unsafe.
- viraptor 8mo agohttps://bandit.readthedocs.io/en/latest/ https://bandit.readthedocs.io/en/latest/ can do that for python.
- chii 8mo agobut then if you could assert the call graph (easily, or even provably correctly), then why not just cull the unused code that led to vulnerability in the first place?
- mseepgood 8mo agoWith a statically compiled language it is usually culled through dead-code elimination (DCE), and with static linking you don’t ship entire libraries.
- chii 8mo agoThe technology to cull code can work for dynamic languages too, even tho it does get difficult sometimes (google closure compiler[1] does dead code elimination for js, for example). It's just that most dynamic language users don't make the attempt (and you end up with this dependabot giving you thousands of false positives due to the deep dependency tree). [1]https://github.com/google/closure-compiler https://github.com/google/closure-compiler
- Gigachad 8mo agoIt’s easier to just update the package and not have to worry.