Re:The Lisp curse, now coming to your ecosystem
by kragen on Thursday November 05, 2026 @02:59PM
(#50383697)
You might be exposing it to attackers without intending to use it.
Re:The Lisp curse, now coming to your ecosystem
by nonethewiser on Thursday November 05, 2026 @03:20PM
(#50383944)
>You still completely ignore the license violations.
The ones that you are imagining to happen? Its not a problem because you could simply observe proper licensing.
>If you aren't using a library function you're not vulnerable to exploits in that code
Not true, just because you arent calling a function doesnt mean it cant run. Read up on Log4Shell.
If you aren't using a library function you're not vulnerable to exploits in that code: unused but imported code is inert (possible usable as a gadget if you're vulnerable elsewhere, but at that point you're screwed anyways) and most compilers/runtimes completely eliminate it.
> you may update a package that was previously good and is now vulnerable (regressions, supply chain attacks)
There are better mitigations to this than not using a library.
You still completely ignore the license violations.