Always Review Your Dependencies, AGPL Edition

Post by lowdose » Mon, Jan 06, 2020, 9:09 AM UTC

cygned wrote: post #41

I try to convince my team that the node.js ecosystem has gotten into a stage where it cannot be used for security/financial applications because the sheer amount of dependencies pose an inherent threat. I advocate for Go because of the tendency to less and easier reviewable dependencies. Nobody except me seems to see a problem there, despite me being able to point out specific security incidents. I am wondering if I…

Post by valvar » Mon, Jan 06, 2020, 9:19 AM UTC

pbhjpbhj wrote: post #28

choeger wrote: post #2

That's the hidden cost of npm, cargo, pip, et. Al. The other one is IMO akin to overweight. Try to modernize a mid-sized project after one or two years and cry when you see the dependency graph. Ceterum censeo go inferior est.

[flagged]

Post by Thorrez » Mon, Jan 06, 2020, 9:25 AM UTC

pedrocx486 wrote: post #47

Doctor_Fegg wrote: post #39

Earlier quoted context omitted.

CC0 is a licence. "Public domain" is a state. Some works have no copyright, typically because they're the product of a US Federal institution, or the copyright has expired. In American English this copyright-free state is also known as "public domain". (In British English it can mean something quite different.) To put something in the "public domain", you need to make a statement of such. In other words, a licence. Y…

>Alternatively, you can use WTFPL, which is a really great way of putting your works in the public domain while guaranteeing that bigcorps won't use them I thought the point of WTFPL was that you didn't care who used your code for what.

Post by m4rtink » Mon, Jan 06, 2020, 9:29 AM UTC

256dpi wrote: post #10

sansnomme wrote: post #4

Package managers need to automatically derive properties of end builds based on licenses. E.g. Eclipse License 2.0 without the presence of another more liberal license means it cannot be used in copyleft software, any dependency that is copyleft is also infectious etc. Of course it won't account for every single legal property but the basic checks should be done. To prevent work duplication a single binary/library wr…

The licensing of a dependency could be easily determined programmatically (GitHub already built a decent scanner). However, I think that the quality of a dependency is most important and that requires a manual vetting process. A trivial solution would be to create a crowd-sourced dependency vetting platform.

Post by pomhellxml » Mon, Jan 06, 2020, 9:36 AM UTC

eitland wrote: post #52

cygned wrote: post #41

I try to convince my team that the node.js ecosystem has gotten into a stage where it cannot be used for security/financial applications because the sheer amount of dependencies pose an inherent threat. I advocate for Go because of the tendency to less and easier reviewable dependencies. Nobody except me seems to see a problem there, despite me being able to point out specific security incidents. I am wondering if I…

There's also Java and .NET for those who want better IDE support, better dependency management (without recursively downloading hundreds of packages), and a more traditional language and more fully featured language. PS: I came to statically typed languages as an adult, I actually disliked those languages before I had the lightbulb moment, so I think I might even be more qualified than everyone who hasn't managed to…