Re:State of the Software Supply Chain 2021
by stephen-magill on Wednesday September 15, 2021 @10:47AM
(#28539796)
Yep. The question is whether the engineering trade-offs are worth it. Less-used libraries might have more undiscovered bugs that crop up in production and could have lower levels of support as well.
Perhaps 'security by obscurity' has its parallel in 'vulnerability in popularity'.
While not a good security tactic in general, there is something to the fact that an obscure library will be less exploited.