Should we start shaming developers who don't use isolation? (opens in new tab)

Intro It seems we are seeing supply-chain attacks every other day now. There are two main reasons for this:\nProjects have too many dependencies. JS projects can easily reach 1000+ transitive dependencies. Projects usually run without any isolation from the rest of the developer’s computer, allowing any attack to easily propagate. Much has been written about the former. It may require the industry to adopt a different mindset, which is always hard. Instead, I want to talk about the latter, wh...