>If you're pulling in a package that has 400 dependencies, how the heck would you even competently check 10% of that surface area?
This would be where different security advice would apply: don't pull in a package that has 400 dependencies.
This would be where different security advice would apply: don't pull in a package that has 400 dependencies.
Of course not. We do the fun parts, and write tickets to make the dev team do the boring parts that we will later complain are not implemented to the quality standard we would have reached, had we done the work. That's the deal.
I literally just finished up writing up something that does supply chain provenance checking across 9 languages and still have a lot of edge cases to handle. It's not fun, but it's honest work.