2 ms·

I love the extreme tension between "small, clean code you write/verify yourself" and "opaque-ish package for everything". Because the latter is so much more pr

by trevyn 9y ago

I love the extreme tension between "small, clean code you write/verify yourself" and "opaque-ish package for everything". Because the latter is so much more productive, I think the real question is, how do we manage the undesirable side-effects of the package-for-everything model? I see the major concerns as: - Potential security problems that evolve over time. - Reduced understanding of how the underlying code works. - Reduced mental clarity of how the project as a whole works. - Non-traditional approach to debugging. (Dig through foreign code, post GitHub issues.) - Artifact size / performance / power consumption issues. I'm curious about novel approaches to help manage these concerns.

ryandrake 9y ago
Don't forget licensing issues, which a lot of smaller companies maybe just look the other way on. That code you just copied and pasted from the web--what was it licensed under? Is it compatible with your company's software licensing? That 3rd party package you just deemed a critical dependency, how is that licensed? The "grownup" companies I've worked for either explicitly ban or discourage "Programming by copy/paste from the Internet" and have review processes to gate inclusion of 3rd party code so that the licensing can be reviewed. Licensing issues aside, 1. as a tech lead, I would feel obligated to act as the gate for bringing 3rd party dependencies into the project, and 2. if you cut paste code into my project, then during code review, you should be able to explain in great detail what it does. If you can't, it gets reverted.
lmm 9y ago
Make it easier to understand exactly what any library function does from its signature, i.e. strong norms of functional purity (perhaps at the language level) combined with some way of representing effects (language-level effect systems, monads and the various constructions on top of them, or something else).

by trevyn 9y ago

ryandrake 9y ago

Don't forget licensing issues, which a lot of smaller companies maybe just look the other way on. That code you just copied and pasted from the web--what was it licensed under? Is it compatible with your company's software licensing? That 3rd party package you just deemed a critical dependency, how is that licensed? The "grownup" companies I've worked for either explicitly ban or discourage "Programming by copy/paste from the Internet" and have review processes to gate inclusion of 3rd party code so that the licensing can be reviewed. Licensing issues aside, 1. as a tech lead, I would feel obligated to act as the gate for bringing 3rd party dependencies into the project, and 2. if you cut paste code into my project, then during code review, you should be able to explain in great detail what it does. If you can't, it gets reverted.

lmm 9y ago

Make it easier to understand exactly what any library function does from its signature, i.e. strong norms of functional purity (perhaps at the language level) combined with some way of representing effects (language-level effect systems, monads and the various constructions on top of them, or something else).