Re:Netmask NPM package, used by 270k+ projects, vulnerable t...
by johannes1234321 on Monday March 29, 2021 @09:53AM
(#26621549)
My hope is that with a larger standard library there is more shared ownership of the library at large.
With many small libraries there often is a single person working on it and others assuming "oh, somebody will have reviewed it"
This can happen with a big library as well (as individual maintainers "own" specific parts) but there it is easier to establish a review culture.
(Whether a review would have caught this specific case is yet another question, but again having an organisation could guarantee a timely response, is read if depending on a single contributor)
With many small libraries there often is a single person working on it and others assuming "oh, somebody will have reviewed it"
This can happen with a big library as well (as individual maintainers "own" specific parts) but there it is easier to establish a review culture.
(Whether a review would have caught this specific case is yet another question, but again having an organisation could guarantee a timely response, is read if depending on a single contributor)