[indymike]

> I have been writing for years that package managers are a big security risk

Like all tools used by humans, package managers are used for great good, and terrible evil. The great good (from a security point of view) is that we can distribute new features and patches quickly and freely. The bad: we can distribute nefarious code just as easily.

> Or just write it yourself.

Writing code is how bugs are created. Often popular libraries are much more robust and secure than bespoke code. Sometimes they are not.

> Learn what your code base does.

Great advice.