3 ms·
"Don't build your own" does not imply "just use what's there blindly". You should have an understanding of the tools you're using, but of course if you try to a
by jameskilton 7y ago
"Don't build your own" does not imply "just use what's there blindly". You should have an understanding of the tools you're using, but of course if you try to audit every line of code you include into your app (God help you if you're using node and npm/yarn) then you'll never get any work done.
At some point you simply have to trust other developers, but don't be afraid to build your own, especially if it's smaller functionality (looking at you left-pad ...).
Dependency management is a skill all developers should learn but it's not one that is actively taught or encouraged. Most (including myself) only really start learning once you've felt the bite of that one bad dependency, or fought through dependency upgrade hell.
In short, make sure you're asking yourself "Do I really need this as a dependency or can I build something myself?"
- Xylakant 7y ago> (God help you if you're using node and npm/yarn) Try to audit gcc if you’re using C :)
- xfer 7y agoYou only have to audit the binary produced, not gcc.
- merb 7y agoand how do you do that? - btw. without reading bit per bit you still have a problem since you can't audit a binary with a full trust chain, i.e. the auditing tool needs to be audited aswell, etc...
- comex 7y agoThere’s CompCert, if you really want to go that far… Then there’s the question of auditing the hardware you’re running on ;)