4 ms·
> Having production ever pull from the interwebs just seems bonkers to me. Is it really that big of an issue if your package manager pins dependencies by hash?
by vova_hn2 8mo ago
> Having production ever pull from the interwebs just seems bonkers to me.
Is it really that big of an issue if your package manager pins dependencies by hash?
I guess, public package registry can be down an brake your pipeline, that's a risk. But I don't see how it introduces any new security problems.
- rlpb 8mo agoPinning dependencies by hash is completely undermined by automation that then updates the pins without meaningful review, as is common.
- vova_hn2 8mo agoI think that this is the issue then, not pulling dependencies from the internet directly. > meaningful review No that I think about it, maybe for the first time in history it's actually feasible to review all the code in the repos using LLMs. Before LLMs were a thing, for any big project that would be way too much work to realistically do it. Also, someone can provide code review of publicly available dependencies as a service, to avoid wasting tokens of reviewing same code again and again by each dev locally on their machine. U wonder if anyone is already working on such service...
- zvr 8mo agoMost (all?) of the solutions offered are not providing a "code review service" but rather a "curated registry" one: download from us and we guarantee some things. It's definitely more widely known/used for container images than individual software packages.