4 ms·
I agree, it’s just the wrong approach. As a user, there’s no way to know if a package has been audited during the cooldown by some generous cybersecurity firm b
by cmckn 2mo ago
I agree, it’s just the wrong approach. As a user, there’s no way to know if a package has been audited during the cooldown by some generous cybersecurity firm before you pull it in, it’s just wishful thinking. Minimizing your dependencies is a more effective strategy against supply chain attacks.
- pixl97 2mo agoHence by writing your own code with its own set of vulns to be detected.
- appplication 2mo agoWell, there’s always woodworking.
- swiftcoder 2mo agoUnless you are a big enough target, there is still potential value to this. Is your business worth enough for someone to spend a lot of money hunting bespoke vulnerabilities? If not, your main risk is being swept in a vulnerability affecting a common dependency, and eliminating the common dependencies removes that risk.
- rcxdude 2mo agoThe way to guarantee that is to pay one of those cybersecurity firms, that's basically their business. And the most effective strategy is to audit and review your dependencies and any updates to them. That probably constrains how many you can have, but just minimizing them is reducing the size of the target, not protecting it per se.