Ask HN: Why does validating a user require 14000 files?

Re:Ask HN: Why does validating a user require 14000 files? by denton-scratch on Monday August 30, 2021 @08:39AM (#28355025)

But Composer is the cause of all those file dependencies. Things like Composer and NPM encourage devs to re-use scores of 3rd-party libraries rather than writing new code; those libraries also rely on NPM/Composer; so they also have scores of dependencies. And it's impractical to audit them all.

I don't understand why people are so willing to depend on these crazy dependency trees, where most of the code was written by people you don't even know the names of.

[ Parent | on HN ]

Re:Ask HN: Why does validating a user require 14000 files? by 0x073 on Monday August 30, 2021 @09:15AM (#28355328)

Before dependency managers, you downloaded a zip with php files from people you dont even know the names of. (And never update any of the external libraries)

These managers dont replace the chain of trust, if you dont trust a dependecy and the developer behind dont install it.

"And it's impractical to audit them all." I dont use NPM but for composer.json: https://github.com/fabpot/local-php-security-checker

I agree, composer is not perfect, but before it was worse.

[ Parent | on HN ]