2 months ago
- - The Log4J vulnerability serves as a cautionary tale, demonstrating how a widely used logging library (168,000 lines of code) can introduce critical security risks.
- - Dependencies accumulate enormous amounts of code (often >1M lines) with an estimated 15–50 bugs per 1,000 lines, leading to thousands of potential issues in imported code.
- - Developers often import full libraries to avoid writing small utility functions, adding unnecessary bloat and unknown code quality.
- - There is a false assumption that packages from official package managers are inherently high quality and secure, despite being maintained by volunteers with no required checks.
- - Dependencies become entrenched and proliferate due to assumed best practices, making removal difficult and causing vulnerabilities to silently accumulate.
- - Poor tooling for detecting unused dependencies leads to stale packages persisting as bloat.
- - Proposed rules: avoid adding dependencies, require explicit justification and logging for each addition, and standardize on a single utility package.