News for hackers. Stuff that matters.

A comment on Open source ‘protestware’ harms Open Source. Parent comment

Re:Open source ‘protestware’ harms Open Source by dewey on Thursday March 24, 2022 @10:21AM (#30790165)
Isn't this mostly a problem of auto-updating and non-pinned dependencies? If you vendor and audit your dependencies this isn't really a problem.
[ Parent | on HN ]
Re:Open source ‘protestware’ harms Open Source by mushyhammer on Thursday March 24, 2022 @10:25AM (#30790220)
Yes true but have you audited your thousands of modules? If you have a build tool that wasn’t born in 2020 chances are it pulls a hundred dependencies from 20 separate vendors.

I saw this as a JS developer who scarily runs npm installs multiple times a day.

[ Parent | on HN ]