Hacker News Reader

This problem exists with all shared code. Shared code, shared fate.

You hope that with more eyes on a library, it'll be more secure. It may also mean vulnerabilities have a higher blast radius. You have to choose where you want to lie on the balance.

Spectre and Log4J - problems on widely deployed tech (Intel CPUs, Java services).

View on HN

Very good point at the end; the lower level you go, the broader (and likely more severe) your vulnerabilities will be. I suppose in this case my concerns aren't warranted, or at least not worth placing before more immediate and obvious concerns. i.e., I could write shitty code a lot more easily than Unison could compromise their language and infrastructure.

Reply on news.ycombinator.com