An alternative:

- copy the dependencies' tests into your own tests

- copy the code in to your codebase as a library using the same review process you would for code from your own team

- treat updates to the library in the same way you would for updates to your own code

Apparently, this extra work will now not be a problem, because we have AI making us 10x more efficient. To be honest, even without AI, we should've been doing this from the start, even if I understand why we haven't. The excuses are starting to wear thin though.

▲

pjc50 10 hours ago | parent | next [-]

Just going to put features on hold for a month while I review the latest changes to ffmpeg.

▲

tick_tock_tick 11 hours ago | parent | prev [-]

I don't know where you've worked but a hostile and intelligent actor or internal red team would succeed under each of those cases at every job I've worked at.

	▲	Hackbraten 9 hours ago \| parent \| next [-]
		Defending against a targeted attack is difficult, yes. But these recent campaigns were all directed at everyone. Auditing and inspecting your dependencies does absolutely help thwart that because there will always be people who don't.
	▲	bitwank 10 hours ago \| parent \| prev [-]
		Good to know. Where were the places you worked at?