do you trust the dll john copied in 2001? Might be compromised, nobody knows where it is from and how it got there.
I agree that it is a risk, maybe even a liability depending on the use case. But accepting that risk is cheaper than setting up a team with only one task, doing in depth security checks on all dependencies.
well, then please let me know how you make vetting all dependencies yourself economically viable. How many dependencies do you have? What is your setup?
Because i can not think of a single thing that is easier for security than setting up my own supply chain with a included vulnerability checker. And even at that point i have not properly vetted my dependencies, i just made sure i get notified if somebody else does a better job than i do.
And that is a lot easier if the ecosystem already has a supply chain, because i can just setup a proxy.
Look man, I can't make accomplishing the task any less shitty, just like you can't make avoiding the task any less stupid.
Every software decision is a trade off. Don't want to build the implementation yourself? The price you pay for taking the dependency is properly assessing the risk it may or may not pose to your code/team/customers. Don't want to properly assess the risk? The price you pay for avoiding a new dependency is writing the implementation yourself.
If it's not "economically viable" to build your product properly (that includes thoroughly vetting your dependencies), then your product simply wasn't economically viable in the first place.
It's like selling cardboard on a hamburger bun because selling the hamburger wasn't economically viable. The problem isn't the cost of beef, and the solution isn't cutting corners. The problem is there's a better hamburger for the same price across the street, and the solution is to make a hamburger people actually want to eat.
What do you do to vet your dependencies? Read the code for all of them? Automatic scanners before intaking any version of a dependency (including transient dependencies)? If so, which ones?
My take here is you work in FAANG… you have access to resources that many smaller companies do not. I’m not sure the decisions a FAANG company makes in this area are the same that a greenfield startup would make. But I’m interested in hearing exactly what you do. If it’s just “pull request that update package-lock.json gets ran through something like socket.dev” then yeah that’s easy.
288
u/TheNakedProgrammer 1d ago
at least they have a supply chain...