TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

The best free, open-source supply-chain security tool? The lockfile

5 pointsby moyerover 3 years ago

1 comment

ievansover 3 years ago
Author here. The idea for this post came about after a HN reply (<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=28965469" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=28965469</a>) to one of my comments about the ua-parser-js issue. And the most recent trigger was a conversation with some Ruby developers about whether or not Gemfile.lock provided any security benefits (as you can see from the chart, bundler is an outlier compared to pip&#x2F;npm&#x2F;yarn). I wanted to collect the arguments for and against lockfiles and examine how widely supported the most critical features; would love feedback on the arguments as well as whether I’ve gotten the details write on which package manager supports what.