News for hackers. Stuff that matters.

A comment on Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies. Parent comment

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by throwaheyy on Wednesday February 10, 2021 @01:13PM (#26092750)
Who said anything about requiring a full code audit? Parent post is suggesting being selective about which packages you consume and which third-party developers you trust, including transitive dependencies pulled in by any package you consume.
[ Parent | on HN ]
Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by HereBeBeasties on Wednesday February 10, 2021 @06:04PM (#26096061)
I just don't think that's realistic for the JavaScript ecosystem, for the majority of projects. E.g. The weight of something "standard" like create-react-app.
[ Parent | on HN ]