Shearing point

Comments

• mormegil@programming.dev ⁨3⁩ ⁨days⁩ ago

  Another level of this dilemma:

  • Pin all dependency versions – Prevents receiving security patches
  • Don’t pin dependency versions – Enables supply chain attacks (see nesbitt.io/…/incident-report-cve-2024-yikes.html)

  source
• yessikg@fedia.io ⁨1⁩ ⁨week⁩ ago

  When I do a security audit on apps with hundreds of dependencies, I die a little bit

  source

  • CanadaPlus@lemmy.sdf.org ⁨1⁩ ⁨week⁩ ago

    Does it matter what kind of dependancy? Like, sure, if it’s somebody’s 5-year-old school project that’s bad, I guess. (I’m experiencing this meme right now)

    source
• jbrains@sh.itjust.works ⁨1⁩ ⁨week⁩ ago

  Depend on abstractions. This isn’t hard. 🤷

  source
• nova_ad_vitum@lemmy.ca ⁨1⁩ ⁨week⁩ ago

  Reuse is only good in the context of 90s era OO programming wisdom of “Coupling is bad, cohesion is good”.

  source

  • Metype@pawb.social ⁨1⁩ ⁨week⁩ ago

    Wait so I should reinvent the wheel constantly! I knew I was right about that!!

    source

    • olafurp@lemmy.world ⁨1⁩ ⁨week⁩ ago

      I also think an implementation should depend on how many the developer remembers to change

      source
• TootSweet@lemmy.world ⁨1⁩ ⁨week⁩ ago

  “A little copying is better than a little dependency.”

  source

  • tatterdemalion@programming.dev ⁨1⁩ ⁨week⁩ ago

    Judgement call. When it’s something prone to change that’s hard to get right, duplicating it just creates more maintenance burden.

    source

    • CanadaPlus@lemmy.sdf.org ⁨1⁩ ⁨week⁩ ago

      Plus, it’s bloat. A snippet of extra code isn’t going to cause much trouble, but then you end up doing it a lot, and there’s snippets in the snippets, and all the sudden something that used to fit on a floppy is 3 gigs.

      I have no idea how much of a factor this is relative other various performance-sacrificing shortcuts, but Wirth’s law is a thing.

      source
    • TootSweet@lemmy.world ⁨1⁩ ⁨week⁩ ago

      For sure. But I’ve seen a lot more sins committed in the name of reusing code than in the name of minimizing dependencies.

      source