U.S. tightens export controls on items used in surveillance of private citizens

Re:U.S. tightens export controls on items used in surveillan... by lumost on Wednesday October 20, 2021 @08:18PM (#28938618)

As long as the solution demands radically slower development there will be problems. Do you really believe that a team of 5 overworked devs will re-implement all functionality pulled in by laravel and their app without introducing yet more vulnerabilities?

[ Parent | on HN ]

Re:U.S. tightens export controls on items used in surveillan... by bbarnett on Thursday October 21, 2021 @05:11AM (#28942108)

The point of a framework was, historically, a project which implemented secure, shared, many eyes-on code. Proper code reuse.

Now, with 20k node packages pulled in as deps for a couple of 10 line libraries, or with 100s of phars as deps often for 10 line composer sourced libraries, you often have almost no eyes on for that code reuse.

Devs just indiscriminately pull stuff in, don't care if a package is unmaintained, or was written by someone for fun 5 years ago and abandoned.

This model isn't sane code reuse.

At least with code written by an on site dev, one can have code reviews, sign offs, etc.

None of this even touches on things like hostiles taking over packages, either.

I'll put this another way. Do you audit every single non-core package installed from random sites, at each update, and all its dependencies?

Or, do you even audit each package, all deps, to make sure the project is active, and seems to have a competent admin?

Because code reuse logic means lots of eyes, and abandoned stuff, low use stuff doesn't jive with that.

[ Parent | on HN ]