Re:Backdoor in event-stream library dependency
by chomp on Monday November 26, 2018 @12:15PM
(#18534903)
I would caution one to not have tons of dependencies. More surface area in terms of the amount of 3rd party libraries/developers means more chances that one of them is not a responsible maintainer, as in this case. That increases the application's security risk.
[ Parent
| on HN ]
Re:Backdoor in event-stream library dependency
by yetanotherjosh on Tuesday November 27, 2018 @03:07PM
(#18546185)
Then let's hope you're not using Webpack, which alone has several hundred of them and not small ones, mind you... super complex libraries that trying to "own" enough that you'd be able to securely review code diffs is completely infeasible.