A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a copy of the Composer dir and opened up WinMerge to display the differences for me to manually go through.
Initially, I thought I was oh-so-clever for doing this, and eagerly looked at every new change to verify that they didn't add some evil malware code.
Then, as the updates kept coming in regularly, I paid less and less attention...
Until today, when I got so sick of this that I removed the entire mechanism and reverted back to just blindly letting it fetch whatever it wants and me not verifying anything about it manually.
It's bad enough to do this for my own code (mostly to make sure I didn't leave in something temporary in by mistake when working on a bunch of different files in my system), but doing this for others' massive code trees is just hellish.
They would frequently edit many different files -- it wasn't just one line in one file per update or anything. I just couldn't keep on doing it. It's unthinkable.
But now, I obviously feel bad for not doing it again. And it makes me wonder: does anyone really do this in the entire world? Considering how little effort people seem to put into almost everything, I cannot imagine that many people sit there and go through all the updates.
And let's be honest: even if I did continue doing this, I may not even catch the subtle introduced bug/hole, which may happen gradually through many small changes over time. And of course the rest of my computer is full of uncontrolled proprietary nightmare blobs which do unknown stuff around the clock...
