GitHub package firewall(github.blog)
6 points by soheilpro | 0 comments
GitHub changelog post announcing the public preview of GitHub package firewall, a feature for protecting against malicious or risky package dependencies.
#dependencies on Hacker News
7 stories tagged dependencies, newest first.
The Xkcd thing, now interactive(editor.p5js.org)
1191 points by memalign | 152 comments
A p5.js sketch by isohedral offering an interactive version of the xkcd 'Dependency' comic about fragile software dependency stacks.
NPM flooded with malicious packages downloaded more than 86k times(arstechnica.com)
349 points by jnord | 248 comments
Ars Technica article on the PhantomRaven campaign, in which malicious NPM packages that fetch dependencies from untrusted sites were downloaded over 86,000 times.
Less is safer: Reducing the risk of supply chain attacks(obsidian.md)
476 points by saeedesmaili | 226 comments
Obsidian blog post explaining how the note-taking app minimizes dependencies and other design choices to reduce the risk of software supply chain attacks.
Rust’s dependencies are starting to worry me(vincents.dev)
378 points by chaosprint | 494 comments
Blog post by a Rust enthusiast expressing concern about the number and trustworthiness of dependencies pulled in from crates.io in Rust projects.
We are destroying software(antirez.com)
842 points by antirez | 553 comments
Blog post by antirez arguing that software is being degraded by complexity, bloated dependency chains, complex build systems, broken backward compatibility, and needless rewrites.
Cold-blooded software(dubroy.com)
499 points by arbesman | 198 comments
Patrick Dubroy's blog essay using cold-blooded animals as a metaphor for software that can sit untouched for long periods and still work when revived.