News for hackers. Stuff that matters.

A comment on Why has software supply chain security exploded?. Parent comment

Re:Why has software supply chain security exploded? by wongarsu on Wednesday September 07, 2022 @07:02AM (#32748999)
Had they written all the dependencies themselves, would they have been as secure and robust?

The tradeoff isn't simple, and will be different for each company. I think everyone can point at a couple of components that are complex and massively benefit from the work poured into them and the large install base finding all the edge cases. Equally everyone can name a couple of dependencies that anyone could rewrite in a couple hours, and maybe even improve on the way.

[ Parent | on HN ]
Re:Why has software supply chain security exploded? by taneq on Wednesday September 07, 2022 @07:25AM (#32749170)
Maybe, maybe not, but they certainly wouldn’t have included as many widespread, well known vulnerabilities with exploits already in the wild. And even if the imported code was perfect at the time it was imported, pulling in changes automatically is still an attack vector that you could drive a fleet of buses through.

Note that I’m not saying “never use libraries”, which your points seem mainly aimed at. Code reuse is great! I’m just not sold on automatic, unmonitored updates to libraries.

[ Parent | on HN ]