5 ms·

why? I mean it takes far less than 15 minutes to install a module, so why should I implement it myself?

• jenscow 8y ago
  Like left-pad? By adding more 3rd party dependencies (and theirs) you're increasing risk.
  • djtriptych 8y ago
    You’re increasing risk by writing it yourself too.
    • aldoushuxley001 8y ago
      Not if it's written in a language like e.g. Python with Django framework, where theres generally one or only a few accepted best implementations. It means there's less leaks through the cracks because everything is better integrated instead of loosely tied together.
    • jenscow 8y ago
      Not if it's something that takes 15 minutes to implement :)
• Chris_Newton 8y ago
  Importing anything into a project, no matter how small, creates a new dependency. Any additional dependency introduces, among other costs: * a potential point of failure * a potential source of security vulnerabilities * a potential legal liability and maybe some licensing constraints, and * an additional aspect that needs to be maintained indefinitely and understood by any future developers. Accepting all of this just to save a few minutes writing a simple function and maybe a test or two doesn’t scale very well. At best, it is replacing a superficial problem with a deep set of extra and ongoing responsibilities. This is before we consider the time required to find and evaluate a suitable package, and even then, there is no guarantee that some random small NPM package from a source you’ve never heard of will be any better than what you’d have written yourself if you’re a halfway decent programmer.
  • pojzon 8y ago
    Unfortunety the moment the person you explained that to understood it. 50 new young developers joined the bandwagon of "download everythink, think later".. Thats the issue with frontend.
  • winstonewert 8y ago
    But code I write is also a potential source of failures, security vulnerabilities, and future maintenance burden. These are costs which, for the most part, apply to code whether you import it or write it yourself. In fact, the imported code is arguably better in many cases because if there is a problem in my code it only gets fixed if I fix it. At least sometimes, problems in my imported code gets identified and fixed by other people.
    • Chris_Newton 8y ago
      But code I write is also a potential source of failures, security vulnerabilities, and future maintenance burden. Perhaps, but the mere act of having an external dependency creates all of those liabilities on a significant scale in addition to any risks inherent in whatever functionality is being implemented. If those inherent risks are also significant and you can mitigate them by importing a good implementation of the required functionality instead of building your own, that can be a trade-off worth making. It would rarely be a good idea to use a home-grown encryption algorithm, for example. However, if we’re talking about simple functionality that you could write yourself in minutes anyway and where you would have to try quite hard to create a significant vulnerability or to need much ongoing maintenance, the costs introduced by importing the functionality instead will often be disproportionate.
      • winstonewert 8y ago
        > Perhaps, but the mere act of having an external dependency creates all of those liabilities on a significant scale in addition to any risks inherent in whatever functionality is being implemented. Why? What is different about an external dependency that creates this risks in excess of writing it myself? To me, these risks all seem less when importing then writing it myself. No matter how crappy the module I find is, its gone a lot more testing and review than whatever code I'd write to replace it.