Re:Many packages suddenly disappeared
by dmitriid on Saturday January 06, 2018 @04:36PM
(#16087597)
On top of that, they way countless packages are used everywhere is potentially exploitable: https://medium.com/@david.gilbertson/im-harvesting-credit-ca...
[ Parent
| on HN ]
Re:Many packages suddenly disappeared
by razorunreal on Saturday January 06, 2018 @08:16PM
(#16088496)
In case anyone was considering sending him $10, no, his hypothetical code would not be running on the Google login page. Google does not pull in external dependencies willy nilly like that.
I'd be surprised if they ran a thorough security audit on all code they import, but I'd rather believe they do.
On Google scale you quite certainly want to do that. Not just for security, but for legal reasons. You really don't want to end up using for example AGPL licensed stuff in wrong places and if you just blindly pull stuff with dependencies from package manager, this could easily happen.
Re:Many packages suddenly disappeared
by thanatropism on Sunday January 07, 2018 @08:30PM
(#16094000)
One of the recent True Geordie podcasts features the "YouPorn Guy" who talks about finding it near impossible to get lawyers not on a retainer from Google to fight them.
Sure a legal audit is standard and usually much simpler than a full source audit for security, which has a complexity proportional to the project size.