[kankerlijer]

It's more work and more restrictive I suppose. Any business is free to set up jfrog Artifactory and only allow the installation of approved dependencies. And anyone can pull Ironbank images I believe.

[cxr]

Eschewing with lockfile-based package management schemes actually takes less work.

<https://news.ycombinator.com/item?id=46008744>