Package Managers

I try to avoid projects which make use of package managers.

I understand the convenience and that you can lock dependencies to a specific version. And normally it would be feasible to audit it. But people which use package managers reached a tier of insanity, where they end up with so much transitive dependencies, which makes it impossible to audit it.

However, this could also happen with vendored dependencies, but it is less likely, since vendoring requires you to do many steps manually. And people which do a lot of things manually tend to be more aware and careful what they include.

Curl piped to sh

This pattern:

curl --proto '=https' --tlsv1.2 -sSf https://sh.example.foo | sh

Don't do it.

Bug Bounties

Bug Bounties are a good idea at first glance. A researcher finds some exploit, reports it and gets rewarded. The company benefits from a more secure and stable software. Win-Win.

But some companies employ very restrictive rules or just don't agree on the common 90 days disclosure agreement. They basically disallow you to speak about your findings while fixing nothing.

You must be aware that some companies are just using Bug Bounty programs as PR stunt. They're not really interested in any findings or they just downplay the issue.