Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Thursday, 27-Mar-2025 23:25:06 JST Rich Felker

   Policy I wish software maintainers would follow regarding dependencies:

   - If the dependency is external interface surface (certificate policy, network protocols that might add extensions the user will need to communicate, interchange file formats, etc.) honor the system one.

   - If the dependency is completely internal and computational, fully vendor it. Check in the known-good copy to your own repo.

   • Embed this notice
     aburka 🫣 (aburka@hachyderm.io)'s status on Thursday, 27-Mar-2025 23:37:13 JST aburka 🫣

     in reply to

     @dalias would that it were always simple to determine the difference...

   • Embed this notice
     cliffle@hachyderm.io's status on Thursday, 27-Mar-2025 23:59:56 JST cliffle

     in reply to

     @dalias While I think you've got a point here, the main caveat I'd offer is around security vulnerabilities. I keep finding "no dependency" programs (which in practice means they vendored, or just copy-pastad, some code) with out-of-date and vulnerable versions of things.

     If every program did this, the process of stamping out those vulns would be very involved.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Friday, 28-Mar-2025 00:02:56 JST Rich Felker

     in reply to

     • cliffle

     @cliffle In order to be vulnerable it has to have some interface surface with malicious data, which usually means it's not entirely internal. In some rare cases, this does happen where the interface surface is just race conditions or something that can be exploited without an explicit interface surface. But usually it means we're in the case where it's between the extremes of purly internal and external interface surface.

   • Embed this notice
     cliffle@hachyderm.io's status on Friday, 28-Mar-2025 01:41:43 JST cliffle

     in reply to

     @dalias fair. Sometimes it can be difficult to predict which interfaces wind up being external, of course. For instance, if one component can be tricked into skipping a validation layer and handing a block of code to a more internal component, any issues in that internal component could be accessible.

     Really though, what we're getting at is that distinguishing internal from external can be hard and takes a judgement call.