One of the things that the recent Python cryptography debate has highlighted to me is how much we depend on this distribution of libraries like this. In that case, it's normal to just automatically get updates from a product and then one day, a whole bunch of software projects suddenly notice and, luckily, break (lucky, as opposed to being compromised). In this case, it's normal to just type a project name in install software, with very little vetting done by many people. I want to work on someone's web app, npm suddenly downloads the world. Who's actually audited all that? I know I haven't.
Not sure how we could fix it without slowing way down and doing a lot more work.
Not sure how we could fix it without slowing way down and doing a lot more work.