I like the Go philosophy here: if you just need a function, copy the function, don’t import the whole module. A little code duplication is fine, and it significantly narrows your attack surface.
But while I agree with your point in general, you really missed the mark here. The problem with xz wasn’t pulling in sketchy dependencies, it was online bullying of a burned out FOSS dev. That’s not a technical problem, but a support one.
The solution to problems like the xz vulnerability must be about supporting FOSS devs. Review code, donate money, join mailing lists, etc. Be the support these devs need, and push back against outsiders who seem to be engaging in bullying.
I like the Go philosophy here: if you just need a function, copy the function, don’t import the whole module. A little code duplication is fine, and it significantly narrows your attack surface.
But while I agree with your point in general, you really missed the mark here. The problem with xz wasn’t pulling in sketchy dependencies, it was online bullying of a burned out FOSS dev. That’s not a technical problem, but a support one.
The solution to problems like the xz vulnerability must be about supporting FOSS devs. Review code, donate money, join mailing lists, etc. Be the support these devs need, and push back against outsiders who seem to be engaging in bullying.