{"action":"created","issue":{"url":"https://api.github.com/repos/idno/Known/issues/1064","labels_url":"https://api.github.com/repos/idno/Known/issues/1064/labels{/name}","comments_url":"https://api.github.com/repos/idno/Known/issues/1064/comments","events_url":"https://api.github.com/repos/idno/Known/issues/1064/events","html_url":"https://github.com/idno/Known/issues/1064","id":107827931,"number":1064,"title":"Convert Known dependencies to optionally use Composer","user":{"login":"benwerd","id":624104,"avatar_url":"https://avatars.githubusercontent.com/u/624104?v=3","gravatar_id":"","url":"https://api.github.com/users/benwerd","html_url":"https://github.com/benwerd","followers_url":"https://api.github.com/users/benwerd/followers","following_url":"https://api.github.com/users/benwerd/following{/other_user}","gists_url":"https://api.github.com/users/benwerd/gists{/gist_id}","starred_url":"https://api.github.com/users/benwerd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benwerd/subscriptions","organizations_url":"https://api.github.com/users/benwerd/orgs","repos_url":"https://api.github.com/users/benwerd/repos","events_url":"https://api.github.com/users/benwerd/events{/privacy}","received_events_url":"https://api.github.com/users/benwerd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-09-23T00:10:26Z","updated_at":"2016-01-30T07:57:19Z","closed_at":null,"body":"Because it's 2015.\r\n\r\n<bountysource-plugin>\r\n---\r\nWant to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/26882544-convert-known-dependencies-to-optionally-use-composer?utm_campaign=plugin&utm_content=tracker%2F300028&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F300028&utm_medium=issues&utm_source=github).\r\n</bountysource-plugin>"},"comment":{"url":"https://api.github.com/repos/idno/Known/issues/comments/177097106","html_url":"https://github.com/idno/Known/issues/1064#issuecomment-177097106","issue_url":"https://api.github.com/repos/idno/Known/issues/1064","id":177097106,"user":{"login":"mapkyca","id":124070,"avatar_url":"https://avatars.githubusercontent.com/u/124070?v=3","gravatar_id":"","url":"https://api.github.com/users/mapkyca","html_url":"https://github.com/mapkyca","followers_url":"https://api.github.com/users/mapkyca/followers","following_url":"https://api.github.com/users/mapkyca/following{/other_user}","gists_url":"https://api.github.com/users/mapkyca/gists{/gist_id}","starred_url":"https://api.github.com/users/mapkyca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mapkyca/subscriptions","organizations_url":"https://api.github.com/users/mapkyca/orgs","repos_url":"https://api.github.com/users/mapkyca/repos","events_url":"https://api.github.com/users/mapkyca/events{/privacy}","received_events_url":"https://api.github.com/users/mapkyca/received_events","type":"User","site_admin":false},"created_at":"2016-01-30T07:57:19Z","updated_at":"2016-01-30T07:57:19Z","body":"<a href=\"\" class=\"u-in-reply-to\"></a><a href=\"https://github.com/idno/Known/issues/1064#issuecomment-177046710\" class=\"u-in-reply-to\"></a>My €0.02 is that including dependencies in the binary are preferable as it gives you everything ready to go and there's less chance of tampering. \r\n\r\nGit submodules are next preferable because since it's a tool you're likely to have installed and you can peg modules to a known release.\r\n\r\nComposer in my view is convenient (although not that convenient because you still have to install composer), but it scares the shit out of me because literally the first thing they tell you to do is \"Please download and run this unverified script directly off the internet, but trust us it'll be *fiiiiiiine*\".\r\n\r\nOr as I said in my previous comment, \"wget rootkit.php\""}}