News for hackers. Stuff that matters.

A comment on NPM package event-source-polyfill compromised by political activists. Parent comment

Re:NPM package event-source-polyfill compromised by politica... by adamscybot on Friday April 08, 2022 @08:56PM (#30964276)
"Depends". The benefits of leaning on open source pays off the majority of the time. Are you exposed to more risk? Yes. Does that mean you shouldnt take that risk? Not really. Otherwise you'd struggle to move quickly and be competitive.

Of course certain things change this balance. Hopefully nuclear power plants dont have NPM in their toolchain. And I believe financial orgs already have quite heavy auditing of dependencies.

[ Parent | on HN ]
Re:NPM package event-source-polyfill compromised by politica... by exfascist on Friday April 08, 2022 @09:47PM (#30964558)
Open source and large dependency trees are orthogonal. You can depend on closed modules in compiled languages, many people do. You can write open source software and only depend on the standard library, many people do.
[ Parent | on HN ]