3 ms·
So these days about every language supports any form of "gem" import. Even Go makes it extra easy because the developer does not even need to care about packag
by alexandrerond 10y ago
So these days about every language supports any form of "gem" import.
Even Go makes it extra easy because the developer does not even need to care about packaging as long as there is a git endpoint with the code.
And there are two ways of seeing this:
- One says that this is awesome. Microlibraries allow to make every little module really good by allowing multiple people to iterate on it. That having 100s of dependencies of small modules that "do their thing right" is better than writing functions oneself, which surely leave some corner cases out and decrease the quality of the applications.
- The other says that this is fucked up. That dependencies break your apps in ways you couldn't have imagined and by surprise. That tracking these problems down is a pain and often requires reading through obscure core that does way more than what you need in the end because it's generalized for every use case. That maintaining dependency hell ends up eating the benefits of not having written the code oneself.
I personally find scary when someone runs "./mvn build", "sbt assembly", "bundle install" and this triggers a download of dozens to hundreds of nested dependencies from a place which has to be online and hopefully hasn't been compromised. On the other side, it is clear that if an existing module does the job, why would you re-invent the wheel? And aren't small modules and microlibraries the expression of "simplicity" the author demands? Not sure there is an easy answer for this debate...
- adyus 10y agoWhat about cherry-picking modules, briefly going through their source code (and, hopefully, test suite), then manually (read: copy/paste) importing them into the project at hand? What are the ethical implications of this, though? Is it different than importing the module directly via package managers, license file and all?
- blub 10y agoI have this same problem with Python apps. One has to verify if the dependencies are acquired in a reasonably secure way, because security is a second (nay third) thought for developers. It also makes it difficult to do offline builds.