> Avoiding 3rd party libraries seems like a false sense of security
To be fair, there is more nuance to your statement.
A lot of it depends on your programming language.
For example with Go, with its extensive and excellent stdlib, you would be foolish to rely on large swathes of 3rd party libraries, because so much can and should be done using the Go stdlib.
On the opposite end of the spectrum, you have Rust with an effectively non-existent stdlib.
And the problem you see frequently with Rust is projects importing half the internet, with a Cargo.toml the length of your arm with hundreds of dependencies. Of course the project has never reviewed its dependencies source code, and the project probably barely keeps its dependencies up to date. Its a supply-chain attack waiting to happen, not if but when.
So with languages like Rust, you have to take an approach of "minimal reasonable dependencies", make an active effort to keep your dependency list short and in-control.[1][2]
> less well audited than public libraries
I also struggle with this particular argument because the reality in open source is "well, its open-source, it has many eyes" is in fact mostly a dream. Since we all know 99% of the time its a small group of maintainers (assuming there is are even multiple maintainers[3]) and not many (if any) external reviewers.
To be fair, there is more nuance to your statement.
A lot of it depends on your programming language.
For example with Go, with its extensive and excellent stdlib, you would be foolish to rely on large swathes of 3rd party libraries, because so much can and should be done using the Go stdlib.
On the opposite end of the spectrum, you have Rust with an effectively non-existent stdlib.
And the problem you see frequently with Rust is projects importing half the internet, with a Cargo.toml the length of your arm with hundreds of dependencies. Of course the project has never reviewed its dependencies source code, and the project probably barely keeps its dependencies up to date. Its a supply-chain attack waiting to happen, not if but when.
So with languages like Rust, you have to take an approach of "minimal reasonable dependencies", make an active effort to keep your dependency list short and in-control.[1][2]
> less well audited than public libraries
I also struggle with this particular argument because the reality in open source is "well, its open-source, it has many eyes" is in fact mostly a dream. Since we all know 99% of the time its a small group of maintainers (assuming there is are even multiple maintainers[3]) and not many (if any) external reviewers.
[1] https://tweedegolf.nl/en/blog/119/sudo-rs-depencencies-when-... [2] https://tweedegolf.nl/en/blog/104/dealing-with-dependencies-... [3] https://xkcd.com/2347/