new | show | ask | jobs Github

thayne 4 hours ago

> But it does mean you need people who are experienced at solving them or who care enough to learn.

That sounds like it's inconvenient to me.

▲

otterley 4 hours ago | parent [-]

The price of security and business continuity is the occasional inconvenience. Tale as old as time.

▲

thayne an hour ago | parent [-]

Vendoring isn't a clear win for security. It may provide some protection against "supply chain" attacks, but makes it more difficult for you to respond to vulnerabilities discovered in the version you vendored. And for business continuity, in many cases depending on an external registry is an acceptable risk.

And both of those concerns can be addressed by using an internal/private registry that mirrors the packages you need.

But in any event, your original question was to elaborate on why vendoring is inconvenient. Whether or not the benefits are worth the inconvenience is a different question, to which IMHO the answer is "it depends". Sometimes it is, and sometimes it isn't.

	▲	otterley an hour ago \| parent [-]
		> Vendoring isn't a clear win for security. It may provide some protection against "supply chain" attacks, but makes it more difficult for you to respond to vulnerabilities discovered in the version you vendored. How so? Whether a dependency is vendored or not, you still have to update it to integrate a security update to that dependency, don't you? The alternative is to not pin your dependencies, but that is far riskier overall. > Whether or not the benefits are worth the inconvenience is a different question I would contend that it is the most important question. :-)