3 ms·

You should not forgive dependency bloat just because Linux makes it a bit easier to handle.

jerf 7y ago
I'm not sure that's an applicable term here. I see "dependency bloat" as an application having a lot of unnecessary dependencies, like when I start a basic project skeleton in Hot Javascript Framework of the Week and get 1,000 dependencies loaded in (which, in npm land, is a conservative number; I felt bad about saying 10,000 but from what I've seen it isn't necessarily far off the mark). But when you have a project that really does touch every XWindows library there is, and really does need to know about every major image format, and really does speak every major network protocol, and runs a full JIT interpreter and compiler, and integrates with every OS security mechanism there is, and uses every build protection library it can find, and on and on... well, better those dependencies than re-implementation of all that from scratch. Fortunately, there aren't very many things nowadays other than a browser that has that characteristic. (Office suites, maybe. QT and other similar things considered as a whole, but not necessarily what any given user of QT will need.)
- panpanna 7y ago
  I was indeed thinking of npm when I wrote that comment but we are starting to see similar problems in some large rust projects. It's simply too easy to add a new dependency. Anyway, some poster child FOSS projects in C++ take hours to compile due to dependency bloat.
EpicEng 7y ago
Which FF dependencies do you think are unnecessary?
spookthesunset 7y ago
And the alternative to depending on those codebases is.....? Write your own? Don't build out the feature? What, exactly do you propose?
- est31 7y ago
  Sometimes you depend on stuff you don't even use. Or your dependency depends on it. Or the stuff only gives you little advantages. E.g. in Rust the failure crate saves you maybe 10 lines of code or such. But it has tons of dependencies. Or the lalrpop library crate depends on things only the binary crate needs because both are named the same way. You end up downloading and building things you don't even need. This stuff is fixable, the problem is that people don't care much about it.

jerf 7y ago

I'm not sure that's an applicable term here. I see "dependency bloat" as an application having a lot of unnecessary dependencies, like when I start a basic project skeleton in Hot Javascript Framework of the Week and get 1,000 dependencies loaded in (which, in npm land, is a conservative number; I felt bad about saying 10,000 but from what I've seen it isn't necessarily far off the mark). But when you have a project that really does touch every XWindows library there is, and really does need to know about every major image format, and really does speak every major network protocol, and runs a full JIT interpreter and compiler, and integrates with every OS security mechanism there is, and uses every build protection library it can find, and on and on... well, better those dependencies than re-implementation of all that from scratch. Fortunately, there aren't very many things nowadays other than a browser that has that characteristic. (Office suites, maybe. QT and other similar things considered as a whole, but not necessarily what any given user of QT will need.)

panpanna 7y ago
I was indeed thinking of npm when I wrote that comment but we are starting to see similar problems in some large rust projects. It's simply too easy to add a new dependency. Anyway, some poster child FOSS projects in C++ take hours to compile due to dependency bloat.

EpicEng 7y ago

Which FF dependencies do you think are unnecessary?

spookthesunset 7y ago

And the alternative to depending on those codebases is.....? Write your own? Don't build out the feature? What, exactly do you propose?

est31 7y ago
Sometimes you depend on stuff you don't even use. Or your dependency depends on it. Or the stuff only gives you little advantages. E.g. in Rust the failure crate saves you maybe 10 lines of code or such. But it has tons of dependencies. Or the lalrpop library crate depends on things only the binary crate needs because both are named the same way. You end up downloading and building things you don't even need. This stuff is fixable, the problem is that people don't care much about it.