Dependencies should be fetched directly from VCS

The author discusses the differences in dependency management between Go and Ruby, highlighting the security benefits of Go's direct VCS fetching and the challenges of auditing dependencies in Ruby.