from Hacker News

Dangerous dependencies in third-party software – the underestimated risk

by Christian_A on 2/9/25, 8:06 PM with 12 comments

  • by userbinator on 2/13/25, 1:15 AM

    Does anyone else find this article's writing style to have some hints of AI?

  • by codebje on 2/13/25, 2:20 AM

    This is something that weighs on my mind a lot. Industry norm is to use 3rd party dependencies, and it's impractical to carefully vet direct dependencies let alone transitive dependencies. The article spits out a big list of reasons to worry about this, but in the end, the possible solutions aren't all that great.

    I have no answers: just questions that haunt me, from time to time.

  • by jmclnx on 2/13/25, 2:19 AM

    First:

    xz vulnerability -- Thus happened because a patch was added by some Linux distros to add functionality for other packages. If openssh was not patched and kept as the OpenBSD people intended, the vulnerability would not have happend. The article seems to indicate it was caused due to other reasons. IIRC, this only affected systemd distros. *BSDs and Slackware did not have this vulnerability.

    Yes, Linux and to a far lesser extent *BSD are living in dependency hell. Windows are worse off.

    But UN*X systems were initially designed to be simple, but many people want to make these systems into M/S Windows Clones. Until UN*X Type Systems get back to their roots, I see no resolution.

    FWIW, the way BSDs are designed, you can avoid a lot of this because they separate third party applications, these are installed outside the base system. People in the BSDs mostly know there are risks to using 3rd party applications, but unlike Linux, BSD users make that decision themselves. Linux distros tend to make these third party applications part of their base system, this forcing risks on the user. The user may not even understand these items have risks that exceed Linux itself.

  • by johnea on 2/13/25, 11:09 PM

    Wow! and the author isn't even a boomer. Amazing.

    npm and pip have demonstrated the issues discussed here repeatedly...