5 ms·
My experience has been that it has a major advantage, in that freeze + offline actually work properly. You can collect the dependencies you need once, put them
by dwroberts 27d ago
My experience has been that it has a major advantage, in that freeze + offline actually work properly. You can collect the dependencies you need once, put them in version control and never ever talk to remote registry again
- LtWorf 27d agoYou mean leave all CVEs open?
- dwroberts 26d agoI guess that’s more of a problem if you use all-encompassing frameworks, but normally the things I’m using are very small components where the CVEs either don’t exist or are inconsequential/unexploitable for the programs I’m building
- LtWorf 26d agoSo you don't track them, have no way of tracking them and just hope for the best. I hope no customer of yours asks for an SBOM :D
- dwroberts 26d agoUpdating every dependency for every kind of CVE is a brute force method for people and organisations that don’t understand the attack surface of the programs they’re producing
- LtWorf 26d agoAnd vendoring without having any idea of what is in there and doing no monitoring is peak engineering?
- dwroberts 26d agoWho is doing what you’re describing? The reason I can confidently freeze and offline stuff is because I’m not taking in whole frameworks, I’m selecting things carefully, and generally do end up reading at least most of the source And what ‘monitoring’ are you going to be doing besides things like CVEs?