3 ms·
Yeah but only google is google. You are not google, your code doesn’t need to google scale and you don’t need to go to their extremes to manage dependencies. Th
by verroq 7y ago
Yeah but only google is google. You are not google, your code doesn’t need to google scale and you don’t need to go to their extremes to manage dependencies. They do it because they are forced to, doesn’t mean it is right or their way is how it should work for everyone.
- OJFord 7y agoThis isn't really a 'wow, look at the crazy stuff Google needs' thing. Any tiny open source project benefits from a reproducible build (when you come back to it months later) and also new versions (with fixed vulnerabilities, and compatibility with the new thing you're trying to do).
- verroq 7y agoNo not really, any tiny open source project isn’t worth the hassle of making a reproducible build for.
- OJFord 7y agoWell, I look at reproducible as a scale (and incidentally, with an increase in effort as you slide along it, too). A certain amount of reproducibility - a container, pinned dependencies - gives such large reward for how easy it is to achieve that it absolutely is worth it for a tiny open source project. Worrying about the possibility of unavailable package registries and revoked signing keys, on the other hand, probably isn't. It's a trade-off. But you certainly don't need to be Google-scale for some of it to be very worth your while.
- michaelmior 7y agoI think this depends on your definition of "reproducible build." If you're talking about builds being bit for bit identical, that might not be worthwhile given the complexities of doing so with most build tools. But if you mean the same versions being used for dependencies, then absolutely.
- OJFord 7y agoYes, I agree completely, as replied to sibling: https://news.ycombinator.com/item?id=20032980 https://news.ycombinator.com/item?id=20032980
- oconnor663 7y agoI haven't worked at Google, but I have worked at Facebook, and I can say with some confidence that in this respect Facebook is Google too :) For sure there are tradeoffs for big projects that don't make sense for small ones. But there are also times where big projects need a tool that's "just better" than what small projects need, and once that tool has been built it can make sense for everyone to use it. I think good, strong, convenient version pinning is an example of the latter, when the tools are available. That was the inspiration for the peru tool (https://github.com/buildinspace/peru https://github.com/buildinspace/peru).
- weberc2 7y agoI agree with this, but I think to the extent that such tools are lacking (or at least that the overhead is prohibitively high for smaller projects), the parent is correct. Thanks for tipping me off to peru; hadn't seen that before.