Vendoring is nice, and I usually prefer it, but you don't always have the time or people for it.
Vendoring + custom build system (Bazel?) for everything is basically googles approach, if what I have read is correct. Definitely better than everything we have, but the resources for it are not something most can afford.
P.S also what mrcus said, if we trust the upstream build process, we may as well trust their binaries.
Kinda relevant, as I saw few comments about how safer languages are the solution.
Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1].
I do the same, but for a different reason. In my mind, they are less accessible, as the end of the line usually has metal guardrails, thus leaving the closer and easier-to-reach carts for other people.
On the other hand, in my area, I have never seen a broken cart, perhaps because they require coins to operate.
I may be on a bit of a tangent here, but the "bar is below the floor" effect (if I can call it that) is often the result of continued experience in multiple (so-called Tier I, in the author's version of it) companies. It leads to stagnation and a lack of concern for the product or result of their work. In other words, if they pay me, and they don't care about the work, why should I?
Such environments can demotivate and sap the joy from most mental work. I guess this is one of the reasons the author is committed only to part-time work. To paraphrase him - this is how he stays sane.
> crates.io db along with juicy tokens for sale. email for buying! (free leak if no offer till sunday >.<)
So far: rickroll → Strong Dog vs Weak Dog meme → future plans → advertisement.