The community decided it's too much effort to vet code before publishing it so h... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

ljm 4 months ago | parent | context | favorite | on: Postmortem: TanStack NPM supply-chain compromise

The community decided it's too much effort to vet code before publishing it so here we are.

(I'm not being stupid, even ten years ago there were arguments on HN about whether you should audit your dependencies)

I landed on the 'yes, you should know what code you are getting involved with' side.

baq 4 months ago [–]

'yes, you should' needs to be reconciled with 'it's f*g expensive' and 'risk is low'.

nowadays, 'risk is low' isn't true anymore and it's actually cheaper to have a robot spit out a reimplementation of the 5.4% of what you need out of your dependencies instead of auditing the 100%.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact