this post was submitted on 31 Mar 2026
26 points (100.0% liked)
Programming
26392 readers
296 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Because in web development it is perfectly normal to use 2 frameworks and 1200 random libraries to do the simplest of things. One compromised library will compromise all applications that rely on it directly or indirectly, no matter how small.
I absolutely hate this aspect of web development and frankly I'm scared every time I type npm install
And it's not just web development.
This mindset has been spreading for... probably decades. Nowadays, it is even pushed by certain popular programming languages, by including toolchains that make it as easy as possible to pull in third-party dependencies while offering standard libraries so minimal that a developer is strongly encouraged to rely on them.
This inevitably leads to a world where software supply chain attacks have massive reach and high chances of success. And threat actors take advantage of it, of course.