Post

Tim Fish
@timfish.dev

Isn't this just like using a lock file but it's more tedious to update dependencies when vulnerabilities are found?

Tim Fish
@timfish.dev

I don't really keep any keys accessible on my machine so I'm happy to trust registries that haven't been compromised in decades. It's a risk but if you can't trust registries we wouldn't use package managers and they haven't fucked up yet.

0 reposts3 likes

Lukas
@german-noob.win

That argument sounds a lot like "i have nothing to hide so I don't need privacy" Maybe the registries themselves are secure but if someone uploads a bad version the registry will happily serve it to you until it's blocked. If it's a transitive dep not even a lock file will save you

Greg Price
@gnprice.bsky.social

Every form of lockfile I've used pins transitive dependencies just the same as it pins direct dependencies. If it doesn't, it's not really doing its job as a lockfile because repeated installs won't get the same software. Certainly they don't solve all problems, though.

Lukas
@german-noob.win

There have been a lot of supply chain attacks recently and automatic dependency management makes it much easier to be affected. Vendoring dependencies is the "correct" way to deal with it but also tedious.