News for hackers. Stuff that matters.

A comment on NPM Vulnerability Discussion on Twitter. Parent comment

Re:NPM Vulnerability Discussion on Twitter by pilif on Tuesday May 10, 2022 @12:45PM (#31329257)
> Of course you could just copy the code, but then that increases LOC in my codebase that I'm responsible for.

Once your company is owned by a supply chain attack or by an RCE in one of your dependencies, you will learn that you are in-fact very much responsible for the code in your external dependencies.

[ Parent | on HN ]
Re:NPM Vulnerability Discussion on Twitter by tylersmith on Tuesday May 10, 2022 @03:30PM (#31331522)
This drives me crazy. If your software is using a library that library is part of your software whether you originated its code or not. If you are responsible for the software then you're responsible for the LOC in every library your software depends on.
[ Parent | on HN ]