undefined | Better HN

0 pointsmarcus_holmes6y ago0 comments

Every time we include a dependency in an application, we give its maintainers commit privileges to production. Who do we trust?

0 comments

2 comments · 2 top-level

0x06y ago

An open source SDK can at least be audited and locked to a particular version, with no hidden shenanigans.

That's only if you don't review the changes, and trace the entry points at least.

j / k navigate · click thread line to collapse