Earlier quoted context omitted.
> Would one be uneasy about calling a library to do stuff than manually messing around with pointers and malloc()? The irony is that the neverending stream of vulnerabilities in 3rd-party dependencies (and lately supply-chain attacks) increasingly show that we should be uneasy. We could never quite answer the question about who is responsible for 3rd-party code that's deployed inside an application: Not the 3rd-party…
> because not having to review the library code is the whole point. That’s just not true at bigger companies that actually care about security rather than pretending to care about security. At my current and last employer, someone needs to review the code before using third-party code. The review is probably not enough to catch subtle bugs like those in the Underhanded C Contest, but at least a general architecture o…
Sure there is a process to get a library approved, and that abstraction makes you feel better but for the guy who's job it is to approve they are not going to spend an entire day reviewing a lib. The abstraction hides what is essentially a "LGTM" its just that takes a week for someone to check it off their outlook todos.
Maybe your experience is different.