16 ms·

Dependency

808 points by kjhughes 6y ago

ericjang 6y ago
What are some examples of this?
- SQueeeeeL 6y ago
  Probably things like YACC https://en.wikipedia.org/wiki/Yacc https://en.wikipedia.org/wiki/Yacc
  - setpatchaddress 6y ago
    Why? There have been alternative implementations since forever.
- deleted 6y ago
  [deleted]
- yjftsjthsd-h 6y ago
  Well the classic example was openssl, although that has thankfully been improved substantially ever since Heartbleed.
  - rectang 6y ago
    Heartbleed was really the watershed moment. "Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL" (2014): https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ https://arstechnica.com/information-technology/2014/04/tech-...
- ipnon 6y ago
  http://left-pad.io/ http://left-pad.io/
  - deleted 6y ago
    [deleted]
- outworlder 6y ago
  curl ? :)
  - kornish 6y ago
    The author of curl has a funny blog post about how random people will sometimes find the curl license in the software of their everyday things (like a Toyota Corolla) and reach out to him asking for help with their things. https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/ https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/
- freen 6y ago
  The timezone database. https://en.m.wikipedia.org/wiki/Tz_database https://en.m.wikipedia.org/wiki/Tz_database
  - azernik 6y ago
    ICANN has been managing/backing it since 2011 (http://mm.icann.org/pipermail/tz/2011-October/008090.html http://mm.icann.org/pipermail/tz/2011-October/008090.html), when the maintainers were sued by some random astrology company.
- KnightHawk3 6y ago
  libinput https://who-t.blogspot.com/2019/10/libinputs-bus-factor-is-1.html https://who-t.blogspot.com/2019/10/libinputs-bus-factor-is-1...
- sinfjotli 6y ago
  Not the most recent article (2016), so things might have changed since then: https://www.infoworld.com/article/3144546/time-is-running-out-for-ntp.html https://www.infoworld.com/article/3144546/time-is-running-ou...
- jsharkey 6y ago
  dnsmasq comes to mind, it runs on quite a few embedded routers. Here's an interview with the author: https://joshuakugler.com/an-interview-with-simon-kelley-the-author-of-dnsmasq.html https://joshuakugler.com/an-interview-with-simon-kelley-the-...
- banana_giraffe 6y ago
  SQLite feels like this to me. It's more than one person, and it's not thankless work (at least, I hope). But still it is critical to a surprising amount of technology, and maintained by a very few people.
  - deleted 6y ago
    [deleted]
  - ricardobeat 6y ago
    SQLite is supported by commercial arrangements (https://sqlite.org/prosupport.html https://sqlite.org/prosupport.html) and used by giant corporations all around the world, quite a different story.
  - outworlder 6y ago
    And, at the same time, it's a very underused piece of tech Every time you think you need a custom file format for a given piece of software... you most likely don't. Just use SQLite. You can use the standard OS file Open/Save dialog box and users will never know the difference. Yes, that means you now have to write SQL statements to manipulate your data. But that also means that you can get lots of complicated data structures on disk and can manipulate them easily, even outside your own software - just fire up the sqlite CLI and point to your file. There are GUIs as well. Things like UNDO/REDO can also be had almost trivially (see https://www.sqlite.org/undoredo.html https://www.sqlite.org/undoredo.html) Sometimes this also means you don't need an external RDBMS even for web apps. I've seen so many apps which co-locate a small database in the same box that might as well have been a single sqlite file. I'm actually maintaining one right now that, although relatively important, will only ever be a single box. But sqlite wasn't 'enterprisey' enough, had to use PG. For a couple of tables. https://www.sqlite.org/whentouse.html https://www.sqlite.org/whentouse.html Subscribe for my next rant on another underused piece of tech... Lua :)
    - nneonneo 6y ago
      sqlite3 is now very heavily used in the Apple ecosystem - all of Core Data is built on it, and many of Apple’s own apps use it to store all kinds of data. It’s a godsend for tinkerers like me too - just point the SQLite CLI at one of the internal DBs (like the Photos database) and all sorts of cool stuff comes spilling out. For on-disk document storage I think Apple mostly uses a mix of plain folders with magic extensions (“packages”) and ZIP files nowadays, although there are definitely a lot of exceptions. SQLite isn’t that great for binary blob storage (relatively speaking) so a folder structure is still more useful there, IMO.
- exhaze 6y ago
  The most newsworthy one in the last year was core js - a JS poly fill library that most other big npm libraries are built on top of. The maintainer is some random guy from a remote part of Russia. About half a year ago, he was sentenced to a prison sentence . He was the sole maintainer of the project (I guess he refused to give other people write access). I’m not sure if any of its dependent projects have done anything about forking the project, but I wouldn’t be surprised if most just ignore it until it causes some hilarious left-padpocalyse.
  - dragonwriter 6y ago
    > The most newsworthy one in the last year was core js - a JS poly fill library that most other big npm libraries are built on top of. The maintainer is some random guy from a remote part of Russia. About half a year ago, he was sentenced to a prison sentence . He was the sole maintainer of the project (I guess he refused to give other people write access). Core-js most recent commit was 4 days ago, and the repo owner stopped both committing and being the sole committer about 7 months ago with no extended interruption in activity (and there've been several patch releases since), so it looks like whatever happened was dealt with quickly.
  - greencar 6y ago
    Source? I love npm stories like this and couldn't find it on the first page of google.
    - saagarjha 6y ago
      https://github.com/zloirock/core-js/issues/548#issuecomment-494112872 https://github.com/zloirock/core-js/issues/548#issuecomment-...
- antongribok 6y ago
  NTP
- woogley 6y ago
  Not exactly a lone developer, but ffmpeg
- hnick 6y ago
  NTP basically was but I think things might have changed since? https://www.infoworld.com/article/3144546/time-is-running-out-for-ntp.html https://www.infoworld.com/article/3144546/time-is-running-ou...
  - becauseiam 6y ago
    ntpd is now looked after by the Network Time Foundation, but more importantly many distributions use other implementations of the protocol like chronyd.
  - iou 6y ago
    https://twitter.com/goldbe/status/1295528530646892545?s=20 https://twitter.com/goldbe/status/1295528530646892545?s=20
- zelly 6y ago
  PGP https://www.propublica.org/article/the-worlds-email-encryption-software-relies-on-one-guy-who-is-going-broke https://www.propublica.org/article/the-worlds-email-encrypti...
- rakoo 6y ago
  OpenSSL is notoriously in this situation: maintained by a few guys for whom it isn't even a full-time job, so they can't really do the proper work of trimming the fat that's all there GnuPG is also maintained mostly by the same original guy, who was going broke a few years back so there was a chance he couldn't work on it anymore (https://www.propublica.org/article/the-worlds-email-encryption-software-relies-on-one-guy-who-is-going-broke https://www.propublica.org/article/the-worlds-email-encrypti...). Fortunately the community came to help and now the future of GPG is a little bit more secure It's not really the same but ssh is literally everywhere. Absolutely none of our sysadmin work would be possible without it, and yet very few of us actually give back to the OpenBSD foundation. If we all gave a penny every time we installed it every year, the foundation would reach its annual goal (https://www.openbsdfoundation.org/campaign2019.html https://www.openbsdfoundation.org/campaign2019.html) but we obviously don't, so they still need to ask for money Also not specifically in this way but pretty much anything that Daniel J. Bernstein does is so good that it becomes a crypto standard. It's kinda ok because the software he does are "finished" in the sense that no new features are neither needed nor wanted, and his work is more about the primitives than the actual libraries. Still, there's a lot of the upcoming standards that all depend on what this single guy did.
  - kepler1 6y ago
    And yet they had to divert resources to entertain the team member who thought it was a good use of everyone's time to change/replace all "whitelist" and "master" terms to non-offensive terminology.
    - jhardy54 6y ago
      Cool post history. Please find a healthier outlet for your ideology.
  - padmadevu 6y ago
    NIce Article!!! Thank you for providing such a great help !!! https://devu.in/devops-certification-training-in-bangalore/ https://devu.in/devops-certification-training-in-bangalore/
- mdoms 6y ago
  JSON.net in .NET land was this type of dependency for many years. It was maintained largely by a single founding developer in New Zealand, eventually even becoming a core dependency of ASP.NET itself. He got hired by MS eventually but it must have been close to a decade of this library being a dep of nearly every .NET web project under James' stewardship.
  - 2bitencryption 6y ago
    nowadays if you fuzz any ASP.NET site hard enough, eventually you are going to encounter a Newtonsoft stacktrace.
- im_dario 6y ago
  My library, mergo [0], is used in Docker, Kubernetes, and other big projects that are the core of what we know as the cloud. At some point, my library caused a bug or two in Docker, impacting how config was loaded. 0: https://github.com/imdario/mergo https://github.com/imdario/mergo
- fanf2 6y ago
  dnsmasq (Simon Kelley) bash (Chet Ramey)
  - saagarjha 6y ago
    Chet also does Readline.
outworlder 6y ago
Image title: > Someday ImageMagick will finally break for good and we'll have a long period of scrambling as we try to reassemble civilization from the rubble. EDIT: don't forget to always hover over the image. Half of XKCD's fun comes from those tidbits.
- WrtCdEvrydy 6y ago
  Honestly, yes, imagemagick is such a ridiculous dependency for everything.
  - Tade0 6y ago
    And at the same time its bus factor is 1.
  - AceJohnny2 6y ago
    Why is GraphicsMagick [1] not a more popular alternative? [1] http://www.graphicsmagick.org/ http://www.graphicsmagick.org/
    - ashtonkem 6y ago
      Same reason any legacy dependency remains; the cost of replacement is higher than the cost of maintenance.
      - AceJohnny2 6y ago
        It's meant to be a drop-in replacement, the cost of replacement should be negligible.
        yareally 6y ago
        There probably still exist some weird edge cases introduced by imagemagick that the developer(s) behind graphicsmagick haven't accounted for. That is, should graphicsmagick account for quirks introduced by imagemagick? If it's meant to truly be a drop-in replacement versus one with some strings attached, I would say the answer is yes. Otherwise, you can't easily just drop it into a system and let it run. Systems built with libraries around long enough as imagemagick likely have all sorts of workarounds built in over the years for that kind of behavior and any deviation from imagemagick might break things more than one expects. We've all been bitten by libraries that claim backwards compatibility with previous versions, only to find out there's breaking changes in some non-trivial use cases the library devs didn't consider. Add those complications on top of switching to a library that is supposed to be a drop in replacement and it can get pretty messy for what seemed like a trivial task.
ferros 6y ago
I wonder what the most critical (and smallest, least maintained) npm package in the world is?
- fao_ 6y ago
  Bold of you to assume it's npm that's being spoken of :D
  - ferros 6y ago
    I was thinking of this: https://www.sciencealert.com/how-a-programmer-almost-broke-the-internet-by-deleting-11-lines-of-code https://www.sciencealert.com/how-a-programmer-almost-broke-t...
    - MisterPea 6y ago
      > The problem was promptly fixed, and for the vast majority of us users, there was no down-time thanks to caching I don't know much about npm management, but I'm assuming it actually had nothing to do with caching? More like most companies have pipelines and breaking dependency changes won't reach prod.
  - jacquesm 6y ago
    Safe assumption.
- deleted 6y ago
  [deleted]
- yakshaving_jgt 6y ago
  Probably the is-thirteen package, for checking if a number is equal to 13.
beervirus 6y ago
And when the Nebraskan sells the project to a scammer, we’re all in trouble.
- m463 6y ago
  version 10.0.0.1: local config and data files backed up to cloud (this actually happened to an ios app I had years ago - gas cubby - one day all the local data about your car - vin number, insurance info, mileage and more became cloud based overnight)
- daenz 6y ago
  Can you do that? I'd be open to selling an open source project that gets over 1M monthly downloads. I can't seem to monetize it otherwise. EDIT>> "Can you do that?" meaning, "Can you sell an open source project?" Not "Can I sell to a scammer?", for people accusing me of planning to commit a crime.
  - atotic 6y ago
    I think there is a market for selling rights to browser extensions. Someone I know with a mildly popular extension got offered $10K by a buyer to completely take over. This market might be one of the reasons why extension API powers have been scaled down.
    - fireattack 6y ago
      Yep, it happened quite a lot. The most famous example probably is Stylish.
  - WrtCdEvrydy 6y ago
    Please don't... we already had our scare in the past when someone handed over the JS project for something to a third party and broke the internet.
    - coreyoconnor 6y ago
      "please don't" doesn't pay the bills. You want those people to avoid transferring the reigns for cash? Find some sustainable way to pay them. No amount of feel good platitudes will do that.
DethNinja 6y ago
This is why you are supposed to choose whichever dependency you add to your project very very carefully. Also, each dependency you add to project is a security risk in itself. I really can’t believe how webdesigners casually add dependencies without a second thought especially with dependency management system like npm. People give C++ lots of hate but thanks to not having an easy way of adding complex dependencies, it has less dependency driven bugs/security issues.
- TylerE 6y ago
  > People give C++ lots of hate but thanks to not having an easy way of adding complex dependencies, it has less dependency driven bugs/security issues. Oh, come on. The number of security issues to things like libssl alone is enormous.
  - pfundstein 6y ago
    Oh come one, you're describing a single dependency which being encryption is generally recommended against rolling your own. Don't try and tell me C++ projects in general have more dependencies than high level languages.
    - rossjudson 6y ago
      Nope, but I'm happy to tell you that C/C++ projects in general have more security flaws than high level languages.
      - pfundstein 6y ago
        Don't shift the goal posts, we're talking specifically about dependencies and dependency driven bugs.
        dodobirdlord 6y ago
        Languages like C++ that lack memory safety have the irritating property that a memory safety error anywhere in the dependency tree can be exploited to attack unrelated parts of the binary. In most languages you don’t have to worry that some stateless pure-function log formatter is secretly the gap in your armor.
rectang 6y ago
Well, the first impulse is naturally to just use what's out there for free and leave it to some other poor sap to shoulder the cost of maintenance. That puts you ahead in the short run, at the cost of higher risk. It takes a strong open source advocacy effort to a reach out and a sophisticated organization to be reached, for such an organization to recognize when it's in their interest to participate in open source maintenance.
aetherspawn 6y ago
Would anyone donate to a service that maps your dependency tree and breaks up your donation to support the projects in your entire tree (not only surface level) proportional to their usage or something like that?
- rabidrat 6y ago
  It's been proposed and tried before, and I think generally deemed not worth it. a) Almost no one donates, b) the donations would be broken up to infinitesimal levels, helping no one, and c) there are people who devote their working lives to OSS without compensation, other people who write a few cute small libraries/tools but don't need the money, and then there are corporations who contribute to open-source for their own benefit. The proportion of money that would go to your favorite OSS heroes would be embarrassingly small; compounded by the low donation level and general dilution.
  - koolba 6y ago
    Also you end up with a handful of people making 1000s of one liner libraries that link to each other in an effort to game such systems.
    - Mtinie 6y ago
      Single line anti-gaming algorithms could be open sourced to combat this.
    - whatch 6y ago
      At the same time other people will be more motivated not to include one-liner libraries to not further dilute donations.
    - m463 6y ago
      Maybe that would lead to 1000s of new possible libraries to use in your projects, some of them useful.
    - talaketu 6y ago
hardmath123 6y ago
A couple years ago I wrote a program to make dependency diagrams just like this! https://github.com/kach/tower-of-power https://github.com/kach/tower-of-power Here's `pdf-redact-tools` from Homebrew: https://github.com/kach/tower-of-power/blob/master/gallery/pdf-redact-tools.box.svg https://github.com/kach/tower-of-power/blob/master/gallery/p... Here's the CS core at Stanford (dependency = prereq): https://github.com/kach/tower-of-power/blob/master/gallery/cs.box.svg https://github.com/kach/tower-of-power/blob/master/gallery/c...
- marcrosoft 6y ago
  Speaking of homebrew, its author definitely fits the tiny block in this cartoon.
  - woodruffw 6y ago
    We're actually a thriving team now, although donations (and more eyeballs!) always help :-)
    - jacquesm 6y ago
      If you didn't ping each other to see this within 15 minutes is a nice testimony regarding the reach of HN.
      - marcrosoft 6y ago
        I honestly don’t know the homebrew team but I use it and it’s the first thing to come to mind when I saw this xkcd. Edit: partly because I also know the original author was denied a job at Google. Imagine the productivity gain this team has given to a company the size of google.
      - ekianjo 6y ago
        There are bots to find out mentions of specific keywords on HN.
      - saagarjha 6y ago
obilgic 6y ago
Yes, It's dependency system's weakness, but also that's what makes this system very strong: If one of those base level things break, everyone who depend on it, will come together and replace/fix it instantly.
- gowld 6y ago
  Or they won't.
  - andresgottlieb 6y ago
    Everything can happen, but your scenario has a very low probability, incentives do work
  - ikt 6y ago
    This precedent suggests they will: https://en.wikipedia.org/wiki/Heartbleed#Root_causes,_possible_lessons,_and_reactions https://en.wikipedia.org/wiki/Heartbleed#Root_causes,_possib... The industry's collective response to the crisis was the Core Infrastructure Initiative, a multimillion-dollar project announced by the Linux Foundation on April 24, 2014 to provide funds to critical elements of the global information infrastructure.[192] The initiative intends to allow lead developers to work full-time on their projects and to pay for security audits, hardware and software infrastructure, travel, and other expenses.[193] OpenSSL is a candidate to become the first recipient of the initiative's funding.[192] After the discovery Google established Project Zero which is tasked with finding zero-day vulnerabilities to help secure the Web and society.[194]
- MisterPea 6y ago
  And according to Linus's law if enough people depend on it, it won't matter how complex the breaking bug is. https://en.wikipedia.org/wiki/Linus%27s_law https://en.wikipedia.org/wiki/Linus%27s_law
- hn_throwaway_99 6y ago
  This is kind of true. Look at the recent security issue with lodash. lodash is a dependency of a huge number of javascript and node projects. For people who would say "don't use tons of random libraries", lodash was a great choice; it was almost the equivalent of a standard library for JS before ES6. Problem was, for all intents and purposes it was abandoned about a year ago. Couple months ago a security issue was reported, it wasn't fixed, and then 'npm audit' started failing builds with lodash as a dependency. It's like all of the sudden half the node ecosystem started failing. The problem was not that the bug wasn't fixed, it's that the original author wasn't really involved any more, and it took a long while for other people with commit rights to figure out just how to get the build working. But the problem with any reasonably complex JS project is that there could easily be thousands of references to lodash. NPM doesn't make it easy to essentially say "I'm changing the namespace of lodash to mean this instead of that." Dependencies are pretty unavoidable, and I think the software engineering community will actually start to get better at handling what happens when a widespread dependency needs to go on life support.
styfle 6y ago
There’s a lot of different metrics to look at when determining if one should install a dependency or not. One such metric I found to be missing for npm dependencies was the install size, which is why I created https://packagephobia.com https://packagephobia.com We need more tools to help make this decision because its easy to add a new dependency but its often hard to remove a dependency.
- dakiol 6y ago
  I'm not sure size is a good metric here. For example, a really tiny npm library like left pad (https://packagephobia.com/result?p=leftpad https://packagephobia.com/result?p=leftpad) is something you don't want to depend on (because you can implement it in a couple of lines), whereas date-fns (https://packagephobia.com/result?p=date-fns https://packagephobia.com/result?p=date-fns), which is way bigger than left pad, is a library I definitely don't mind depending on.
  - styfle 6y ago
    That’s a great example! You looked at the size and determined that it might not be worth bringing on a small dependency when you can implement it yourself (or rather use String.prototype.padStart). It’s not just size alone but size of transitive dependencies. Both examples you gave don’t have any dependencies (the publish size matches the install size). Take a look at some popular dependencies like request or jest and notice the number of transitive dependencies. https://packagephobia.com/result?p=request https://packagephobia.com/result?p=request https://packagephobia.com/result?p=jest https://packagephobia.com/result?p=jest
dx87 6y ago
This trend towards huge dependency trees has started to turn me off getting serious about learning software development. It seems like unless you want to make a toy program, you end up with hundreds of dependencies, most of which are made by volunteers who could decide they don't feel like working on it any more. Even having someone paid to do the work doesn't seem like it matters anymore when you consider that Mozilla just laid off a bunch of technical employees to focus on whatever else. Are there any other solo devs who get "dependency anxiety" and don't want to start working on a project because you worry that you'll have wasted your time if one of the hundreds of dependencies breaks something, and there is nobody to fix it (like a crypto library for example)?
- randall 6y ago
  The flip side is 12 people could run Instagram before acquisition.
- chadash 6y ago
  I'm sorry to hear you feel afraid to learn more software development, but i think these concerns are largely unfounded. First of all, dependencies don't break just because they are unmaintained. If it worked ten years ago, it should still work now. For particularly complicated dependencies, there's a likelihood that they have bugs. But if they are popular, these bugs are often either things you probably won't ever come across or can work around if you do. Finally, the beauty of open source software is that you can fix things yourself! Found a package from 10 years ago that works 99% of the time, but you just need to fix one thing or add one tiny feature? Not a problem, you fork the repo and add what you need.
  - fermienrico 6y ago
    > Finally, the beauty of open source software is that you can fix things yourself! Don't you need proper domain knowledge to hack into the some obscure error for svg conversion inside of cairo? All you were trying to do is to display the company logo.svg from your graphics department who exported it on Illustrator version 5.0 because our company is too poor to go to subscription model for Adobe. May be something goofy in the svg data. You spend next days fixing this open source package, ranting on stackoverflow and finally have to concede and file an bug report on Github. It gets rejected because you have not gathered all the necessary details to file a bug report including proper stack traces and operating system information.
dimitrios1 6y ago
This is describing cURL, isn't it?
gramakri 6y ago
ffmpeg comes to mind
dependenttypes 6y ago
ImageMagick is the ffmpeg of images.
RyanShook 6y ago
I’m constantly amazed by the quality and consistency of the open source community. Can you think of any other industry where massive companies are built on top of free infrastructure?
- tamrix 6y ago
  OpenSource software isn't free. It costs people's time to develop and maintain. Calling it 'free' devalues the projects and their maintainers by giving the impression their time isn't worth anything. We as the OpenSource community need to start moving towards a more sustainable approach to OpenSource development. First step: Stop calling it free.
  - phist_mcgee 6y ago
    Oh god this is the same argument rolled out by opponents of socialised healthcare. If it's free then you are forcing the doctor to work for no pay! Stop splitting hairs over the meaning of 'free' in this context. It is free to the end user, it is not free to the developer or maintainer. I make christmas hampers for the poor, I call them free hampers. Of course they are not free, but to the end user they are. And no, people are not going to start using the word libre, it is not an English word and it is not used widely enough outside of computing and it will probably not catch on. /endrant
  - jfax 6y ago
    I feel like calling Free software 'open source' devalues the project and their maintainers by giving the impression their work can be exploited for non-Free software.
  - f1refly 6y ago
    Yes, I agree, open source software isn't free. Anyone can take it, close it off and steal the fruits of my work to do whatever with it. Calling it "free" devalues the projects and their maintainers by giving the impression they'd rather use a questionable license model than create software for humanity. We as the free software community need to show people who call it open source the door and have them escort out by security so they stop ruining the whole affair. ...what was that money thing you where rambling about?
aljgz 6y ago
Author of one such library faced serious problems. He has opened up yesterday in this blog post. https://medium.com/@behdadesfahbod/if-you-read-one-thing-from-me-please-be-this-2262ec7b8af2?source=friends_link&sk=e29ac54d3fbed71de045ed6a5857280b https://medium.com/@behdadesfahbod/if-you-read-one-thing-fro... His tweet: https://twitter.com/behdadesfahbod/status/1295326945178054659?s=20 https://twitter.com/behdadesfahbod/status/129532694517805465... The library: https://github.com/harfbuzz/harfbuzz https://github.com/harfbuzz/harfbuzz
- cmrdporcupine 6y ago
  Oh wow, he was at Google Waterloo when I first started and was a super nice guy. This is a hard and terrifying read. I really feel for him.
- apta 6y ago
  Who attempted to force his employer to fire him for a code of conduct violation?
  - aljgz 6y ago
    I don't know what part of his story you refer to, if its: "It took me weeks to regain access to my accounts, which were disabled after my employer (Facebook) was notified and embarked on disabling them." I guess they've disabled his account to prevent access of the intelligence services to any sensitive data.
    - apta 6y ago
      It's there in the tweet he links: https://twitter.com/behdadesfahbod/status/1275131870036914177 https://twitter.com/behdadesfahbod/status/127513187003691417...
      - aljgz 6y ago
        I think it's an unrelated issue.
- 6y ago
Quarkonout 6y ago
A big part of Go's success is due to the large and useful standard lib. This kind of ecosystem feature is much more valuable than any language feature. If the Rust guys would understand this and put an async runtime, http server and client, crypto and some more essentials in the standard lib the adoption would be much higher. Than we would have a super robust language and a super robust ecosystem. I don't think the borrow checker is the issue with Rust slow adoption in the mainstream backend business.
- majewsky 6y ago
  I can't speak for the Rust devs, but as far as I'm aware, the longterm plan is to have more stuff in std, but only once they're fairly certain they have the right design. Async/await is a good example. The Rust community explored the design space for async runtimes for several years before they felt comfortable settling on a design for the initial pieces of std. The process is definitely frustratingly slow, but going faster has burned the Rust devs already in the past (just look at how much stuff in std::error::Error is deprecated).
  - steveklabnik 6y ago
    The main problem isn't just that, it's that also, Rust cannot decide that a one-size-fits-all executor is the only one. Different properties are needed for different projects, and blessing any one executor cuts off all of the rest of them. Tokio is fantastic for web services, but is inappropriate for my microcontroller.
    - majewsky 6y ago
      Do you have a notification daemon for every HN comment that mentions Rust? :)
      - steveklabnik 6y ago
        Nope, just use the search bar.
cel1ne 6y ago
I wonder if you could write a program that scans javascript-dependencies for function-usage that could be replaced by suites like lodash, to find and replace "leftpad-style dependencies".
zzo38computer 6y ago
I don't use a lot of dependencies in my software (some uses none except the standard library, or for software that runs on a VM, the VM it runs on (although any implementation can be used)). (Probably the only program I do maintain that has too many dependencies is TeXnicard, because it depends on Ghostscript (which has a lot of dependencies). It also uses PCRE and SQLite3 (which are not so bad, since they don't have other dependencies).) In terms of ImageMagick, I used to use it but now maintain my own set of programs for dealing with picture files (almost entirely written in C, although the ones for converting to/from fax format are in PostScript; I may later write a version in C as well, so that you can use it if you do not have a PostScript interpreter). Like most software I write, I try to not use many dependencies if I can avoid it. (It doesn't use libpng either; it is using LodePNG, which is better in many ways, in my opinion.) (These set of programs I wrote also have many effects that I have not seen in other programs, such as automatic rearranging in a horizontal or vertical strip, removing duplicates from a vertical strip, and making the tensor product of two pictures. There are also file formats ImageMagick does not support.)
skapadia 6y ago
All I think of is Angry Birds when I see that picture...
commonturtle 6y ago
Very well put. I suspect this is one of those xkcd's that will become a timeless classic, just like the one on standards: https://xkcd.com/927/ https://xkcd.com/927/.
KyleBerezin 6y ago
Would you trust the stability of the dependency more if it was maintained by a large company, say, Oracle?

Dependency

808 points by kjhughes 6y ago

ericjang 6y ago

What are some examples of this?

SQueeeeeL 6y ago
Probably things like YACC https://en.wikipedia.org/wiki/Yacc https://en.wikipedia.org/wiki/Yacc
- setpatchaddress 6y ago
  Why? There have been alternative implementations since forever.
deleted 6y ago
[deleted]
yjftsjthsd-h 6y ago
Well the classic example was openssl, although that has thankfully been improved substantially ever since Heartbleed.
- rectang 6y ago
  Heartbleed was really the watershed moment. "Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL" (2014): https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ https://arstechnica.com/information-technology/2014/04/tech-...
ipnon 6y ago
http://left-pad.io/ http://left-pad.io/
- deleted 6y ago
  [deleted]
outworlder 6y ago
curl ? :)
- kornish 6y ago
  The author of curl has a funny blog post about how random people will sometimes find the curl license in the software of their everyday things (like a Toyota Corolla) and reach out to him asking for help with their things. https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/ https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/
freen 6y ago
The timezone database. https://en.m.wikipedia.org/wiki/Tz_database https://en.m.wikipedia.org/wiki/Tz_database
- azernik 6y ago
  ICANN has been managing/backing it since 2011 (http://mm.icann.org/pipermail/tz/2011-October/008090.html http://mm.icann.org/pipermail/tz/2011-October/008090.html), when the maintainers were sued by some random astrology company.
KnightHawk3 6y ago
libinput https://who-t.blogspot.com/2019/10/libinputs-bus-factor-is-1.html https://who-t.blogspot.com/2019/10/libinputs-bus-factor-is-1...
sinfjotli 6y ago
Not the most recent article (2016), so things might have changed since then: https://www.infoworld.com/article/3144546/time-is-running-out-for-ntp.html https://www.infoworld.com/article/3144546/time-is-running-ou...
jsharkey 6y ago
dnsmasq comes to mind, it runs on quite a few embedded routers. Here's an interview with the author: https://joshuakugler.com/an-interview-with-simon-kelley-the-author-of-dnsmasq.html https://joshuakugler.com/an-interview-with-simon-kelley-the-...
banana_giraffe 6y ago
SQLite feels like this to me. It's more than one person, and it's not thankless work (at least, I hope). But still it is critical to a surprising amount of technology, and maintained by a very few people.
- deleted 6y ago
  [deleted]
- ricardobeat 6y ago
  SQLite is supported by commercial arrangements (https://sqlite.org/prosupport.html https://sqlite.org/prosupport.html) and used by giant corporations all around the world, quite a different story.
- outworlder 6y ago
  And, at the same time, it's a very underused piece of tech Every time you think you need a custom file format for a given piece of software... you most likely don't. Just use SQLite. You can use the standard OS file Open/Save dialog box and users will never know the difference. Yes, that means you now have to write SQL statements to manipulate your data. But that also means that you can get lots of complicated data structures on disk and can manipulate them easily, even outside your own software - just fire up the sqlite CLI and point to your file. There are GUIs as well. Things like UNDO/REDO can also be had almost trivially (see https://www.sqlite.org/undoredo.html https://www.sqlite.org/undoredo.html) Sometimes this also means you don't need an external RDBMS even for web apps. I've seen so many apps which co-locate a small database in the same box that might as well have been a single sqlite file. I'm actually maintaining one right now that, although relatively important, will only ever be a single box. But sqlite wasn't 'enterprisey' enough, had to use PG. For a couple of tables. https://www.sqlite.org/whentouse.html https://www.sqlite.org/whentouse.html Subscribe for my next rant on another underused piece of tech... Lua :)
  - nneonneo 6y ago
    sqlite3 is now very heavily used in the Apple ecosystem - all of Core Data is built on it, and many of Apple’s own apps use it to store all kinds of data. It’s a godsend for tinkerers like me too - just point the SQLite CLI at one of the internal DBs (like the Photos database) and all sorts of cool stuff comes spilling out. For on-disk document storage I think Apple mostly uses a mix of plain folders with magic extensions (“packages”) and ZIP files nowadays, although there are definitely a lot of exceptions. SQLite isn’t that great for binary blob storage (relatively speaking) so a folder structure is still more useful there, IMO.
exhaze 6y ago
The most newsworthy one in the last year was core js - a JS poly fill library that most other big npm libraries are built on top of. The maintainer is some random guy from a remote part of Russia. About half a year ago, he was sentenced to a prison sentence . He was the sole maintainer of the project (I guess he refused to give other people write access). I’m not sure if any of its dependent projects have done anything about forking the project, but I wouldn’t be surprised if most just ignore it until it causes some hilarious left-padpocalyse.
- dragonwriter 6y ago
  > The most newsworthy one in the last year was core js - a JS poly fill library that most other big npm libraries are built on top of. The maintainer is some random guy from a remote part of Russia. About half a year ago, he was sentenced to a prison sentence . He was the sole maintainer of the project (I guess he refused to give other people write access). Core-js most recent commit was 4 days ago, and the repo owner stopped both committing and being the sole committer about 7 months ago with no extended interruption in activity (and there've been several patch releases since), so it looks like whatever happened was dealt with quickly.
- greencar 6y ago
  Source? I love npm stories like this and couldn't find it on the first page of google.
  - saagarjha 6y ago
    https://github.com/zloirock/core-js/issues/548#issuecomment-494112872 https://github.com/zloirock/core-js/issues/548#issuecomment-...
antongribok 6y ago
NTP
woogley 6y ago
Not exactly a lone developer, but ffmpeg
hnick 6y ago
NTP basically was but I think things might have changed since? https://www.infoworld.com/article/3144546/time-is-running-out-for-ntp.html https://www.infoworld.com/article/3144546/time-is-running-ou...
- becauseiam 6y ago
  ntpd is now looked after by the Network Time Foundation, but more importantly many distributions use other implementations of the protocol like chronyd.
- iou 6y ago
  https://twitter.com/goldbe/status/1295528530646892545?s=20 https://twitter.com/goldbe/status/1295528530646892545?s=20
zelly 6y ago
PGP https://www.propublica.org/article/the-worlds-email-encryption-software-relies-on-one-guy-who-is-going-broke https://www.propublica.org/article/the-worlds-email-encrypti...
rakoo 6y ago
OpenSSL is notoriously in this situation: maintained by a few guys for whom it isn't even a full-time job, so they can't really do the proper work of trimming the fat that's all there GnuPG is also maintained mostly by the same original guy, who was going broke a few years back so there was a chance he couldn't work on it anymore (https://www.propublica.org/article/the-worlds-email-encryption-software-relies-on-one-guy-who-is-going-broke https://www.propublica.org/article/the-worlds-email-encrypti...). Fortunately the community came to help and now the future of GPG is a little bit more secure It's not really the same but ssh is literally everywhere. Absolutely none of our sysadmin work would be possible without it, and yet very few of us actually give back to the OpenBSD foundation. If we all gave a penny every time we installed it every year, the foundation would reach its annual goal (https://www.openbsdfoundation.org/campaign2019.html https://www.openbsdfoundation.org/campaign2019.html) but we obviously don't, so they still need to ask for money Also not specifically in this way but pretty much anything that Daniel J. Bernstein does is so good that it becomes a crypto standard. It's kinda ok because the software he does are "finished" in the sense that no new features are neither needed nor wanted, and his work is more about the primitives than the actual libraries. Still, there's a lot of the upcoming standards that all depend on what this single guy did.
- kepler1 6y ago
  And yet they had to divert resources to entertain the team member who thought it was a good use of everyone's time to change/replace all "whitelist" and "master" terms to non-offensive terminology.
  - jhardy54 6y ago
    Cool post history. Please find a healthier outlet for your ideology.
- padmadevu 6y ago
  NIce Article!!! Thank you for providing such a great help !!! https://devu.in/devops-certification-training-in-bangalore/ https://devu.in/devops-certification-training-in-bangalore/
mdoms 6y ago
JSON.net in .NET land was this type of dependency for many years. It was maintained largely by a single founding developer in New Zealand, eventually even becoming a core dependency of ASP.NET itself. He got hired by MS eventually but it must have been close to a decade of this library being a dep of nearly every .NET web project under James' stewardship.
- 2bitencryption 6y ago
  nowadays if you fuzz any ASP.NET site hard enough, eventually you are going to encounter a Newtonsoft stacktrace.
im_dario 6y ago
My library, mergo [0], is used in Docker, Kubernetes, and other big projects that are the core of what we know as the cloud. At some point, my library caused a bug or two in Docker, impacting how config was loaded. 0: https://github.com/imdario/mergo https://github.com/imdario/mergo
fanf2 6y ago
dnsmasq (Simon Kelley) bash (Chet Ramey)
- saagarjha 6y ago
  Chet also does Readline.

outworlder 6y ago

Image title: > Someday ImageMagick will finally break for good and we'll have a long period of scrambling as we try to reassemble civilization from the rubble. EDIT: don't forget to always hover over the image. Half of XKCD's fun comes from those tidbits.

WrtCdEvrydy 6y ago
Honestly, yes, imagemagick is such a ridiculous dependency for everything.
- Tade0 6y ago
  And at the same time its bus factor is 1.
- AceJohnny2 6y ago
  Why is GraphicsMagick [1] not a more popular alternative? [1] http://www.graphicsmagick.org/ http://www.graphicsmagick.org/
  - ashtonkem 6y ago
    Same reason any legacy dependency remains; the cost of replacement is higher than the cost of maintenance.
    - AceJohnny2 6y ago
      It's meant to be a drop-in replacement, the cost of replacement should be negligible.
      - yareally 6y ago
        There probably still exist some weird edge cases introduced by imagemagick that the developer(s) behind graphicsmagick haven't accounted for. That is, should graphicsmagick account for quirks introduced by imagemagick? If it's meant to truly be a drop-in replacement versus one with some strings attached, I would say the answer is yes. Otherwise, you can't easily just drop it into a system and let it run. Systems built with libraries around long enough as imagemagick likely have all sorts of workarounds built in over the years for that kind of behavior and any deviation from imagemagick might break things more than one expects. We've all been bitten by libraries that claim backwards compatibility with previous versions, only to find out there's breaking changes in some non-trivial use cases the library devs didn't consider. Add those complications on top of switching to a library that is supposed to be a drop in replacement and it can get pretty messy for what seemed like a trivial task.

ferros 6y ago

I wonder what the most critical (and smallest, least maintained) npm package in the world is?

fao_ 6y ago
Bold of you to assume it's npm that's being spoken of :D
- ferros 6y ago
  I was thinking of this: https://www.sciencealert.com/how-a-programmer-almost-broke-the-internet-by-deleting-11-lines-of-code https://www.sciencealert.com/how-a-programmer-almost-broke-t...
  - MisterPea 6y ago
    > The problem was promptly fixed, and for the vast majority of us users, there was no down-time thanks to caching I don't know much about npm management, but I'm assuming it actually had nothing to do with caching? More like most companies have pipelines and breaking dependency changes won't reach prod.
- jacquesm 6y ago
  Safe assumption.
deleted 6y ago
[deleted]
yakshaving_jgt 6y ago
Probably the is-thirteen package, for checking if a number is equal to 13.

beervirus 6y ago

And when the Nebraskan sells the project to a scammer, we’re all in trouble.

m463 6y ago
version 10.0.0.1: local config and data files backed up to cloud (this actually happened to an ios app I had years ago - gas cubby - one day all the local data about your car - vin number, insurance info, mileage and more became cloud based overnight)
daenz 6y ago
Can you do that? I'd be open to selling an open source project that gets over 1M monthly downloads. I can't seem to monetize it otherwise. EDIT>> "Can you do that?" meaning, "Can you sell an open source project?" Not "Can I sell to a scammer?", for people accusing me of planning to commit a crime.
- atotic 6y ago
  I think there is a market for selling rights to browser extensions. Someone I know with a mildly popular extension got offered $10K by a buyer to completely take over. This market might be one of the reasons why extension API powers have been scaled down.
  - fireattack 6y ago
    Yep, it happened quite a lot. The most famous example probably is Stylish.
- WrtCdEvrydy 6y ago
  Please don't... we already had our scare in the past when someone handed over the JS project for something to a third party and broke the internet.
  - coreyoconnor 6y ago
    "please don't" doesn't pay the bills. You want those people to avoid transferring the reigns for cash? Find some sustainable way to pay them. No amount of feel good platitudes will do that.

DethNinja 6y ago

This is why you are supposed to choose whichever dependency you add to your project very very carefully. Also, each dependency you add to project is a security risk in itself. I really can’t believe how webdesigners casually add dependencies without a second thought especially with dependency management system like npm. People give C++ lots of hate but thanks to not having an easy way of adding complex dependencies, it has less dependency driven bugs/security issues.

TylerE 6y ago
> People give C++ lots of hate but thanks to not having an easy way of adding complex dependencies, it has less dependency driven bugs/security issues. Oh, come on. The number of security issues to things like libssl alone is enormous.
- pfundstein 6y ago
  Oh come one, you're describing a single dependency which being encryption is generally recommended against rolling your own. Don't try and tell me C++ projects in general have more dependencies than high level languages.
  - rossjudson 6y ago
    Nope, but I'm happy to tell you that C/C++ projects in general have more security flaws than high level languages.
    - pfundstein 6y ago
      Don't shift the goal posts, we're talking specifically about dependencies and dependency driven bugs.
      - dodobirdlord 6y ago
        Languages like C++ that lack memory safety have the irritating property that a memory safety error anywhere in the dependency tree can be exploited to attack unrelated parts of the binary. In most languages you don’t have to worry that some stateless pure-function log formatter is secretly the gap in your armor.

rectang 6y ago

Well, the first impulse is naturally to just use what's out there for free and leave it to some other poor sap to shoulder the cost of maintenance. That puts you ahead in the short run, at the cost of higher risk. It takes a strong open source advocacy effort to a reach out and a sophisticated organization to be reached, for such an organization to recognize when it's in their interest to participate in open source maintenance.

aetherspawn 6y ago

Would anyone donate to a service that maps your dependency tree and breaks up your donation to support the projects in your entire tree (not only surface level) proportional to their usage or something like that?

rabidrat 6y ago
It's been proposed and tried before, and I think generally deemed not worth it. a) Almost no one donates, b) the donations would be broken up to infinitesimal levels, helping no one, and c) there are people who devote their working lives to OSS without compensation, other people who write a few cute small libraries/tools but don't need the money, and then there are corporations who contribute to open-source for their own benefit. The proportion of money that would go to your favorite OSS heroes would be embarrassingly small; compounded by the low donation level and general dilution.
- koolba 6y ago
  Also you end up with a handful of people making 1000s of one liner libraries that link to each other in an effort to game such systems.
  - Mtinie 6y ago
    Single line anti-gaming algorithms could be open sourced to combat this.
  - whatch 6y ago
    At the same time other people will be more motivated not to include one-liner libraries to not further dilute donations.
  - m463 6y ago
    Maybe that would lead to 1000s of new possible libraries to use in your projects, some of them useful.
  - talaketu 6y ago

hardmath123 6y ago

A couple years ago I wrote a program to make dependency diagrams just like this! https://github.com/kach/tower-of-power https://github.com/kach/tower-of-power Here's `pdf-redact-tools` from Homebrew: https://github.com/kach/tower-of-power/blob/master/gallery/pdf-redact-tools.box.svg https://github.com/kach/tower-of-power/blob/master/gallery/p... Here's the CS core at Stanford (dependency = prereq): https://github.com/kach/tower-of-power/blob/master/gallery/cs.box.svg https://github.com/kach/tower-of-power/blob/master/gallery/c...

marcrosoft 6y ago
Speaking of homebrew, its author definitely fits the tiny block in this cartoon.
- woodruffw 6y ago
  We're actually a thriving team now, although donations (and more eyeballs!) always help :-)
  - jacquesm 6y ago
    If you didn't ping each other to see this within 15 minutes is a nice testimony regarding the reach of HN.
    - marcrosoft 6y ago
      I honestly don’t know the homebrew team but I use it and it’s the first thing to come to mind when I saw this xkcd. Edit: partly because I also know the original author was denied a job at Google. Imagine the productivity gain this team has given to a company the size of google.
    - ekianjo 6y ago
      There are bots to find out mentions of specific keywords on HN.
    - saagarjha 6y ago

obilgic 6y ago

Yes, It's dependency system's weakness, but also that's what makes this system very strong: If one of those base level things break, everyone who depend on it, will come together and replace/fix it instantly.

gowld 6y ago
Or they won't.
- andresgottlieb 6y ago
  Everything can happen, but your scenario has a very low probability, incentives do work
- ikt 6y ago
  This precedent suggests they will: https://en.wikipedia.org/wiki/Heartbleed#Root_causes,_possible_lessons,_and_reactions https://en.wikipedia.org/wiki/Heartbleed#Root_causes,_possib... The industry's collective response to the crisis was the Core Infrastructure Initiative, a multimillion-dollar project announced by the Linux Foundation on April 24, 2014 to provide funds to critical elements of the global information infrastructure.[192] The initiative intends to allow lead developers to work full-time on their projects and to pay for security audits, hardware and software infrastructure, travel, and other expenses.[193] OpenSSL is a candidate to become the first recipient of the initiative's funding.[192] After the discovery Google established Project Zero which is tasked with finding zero-day vulnerabilities to help secure the Web and society.[194]
MisterPea 6y ago
And according to Linus's law if enough people depend on it, it won't matter how complex the breaking bug is. https://en.wikipedia.org/wiki/Linus%27s_law https://en.wikipedia.org/wiki/Linus%27s_law
hn_throwaway_99 6y ago
This is kind of true. Look at the recent security issue with lodash. lodash is a dependency of a huge number of javascript and node projects. For people who would say "don't use tons of random libraries", lodash was a great choice; it was almost the equivalent of a standard library for JS before ES6. Problem was, for all intents and purposes it was abandoned about a year ago. Couple months ago a security issue was reported, it wasn't fixed, and then 'npm audit' started failing builds with lodash as a dependency. It's like all of the sudden half the node ecosystem started failing. The problem was not that the bug wasn't fixed, it's that the original author wasn't really involved any more, and it took a long while for other people with commit rights to figure out just how to get the build working. But the problem with any reasonably complex JS project is that there could easily be thousands of references to lodash. NPM doesn't make it easy to essentially say "I'm changing the namespace of lodash to mean this instead of that." Dependencies are pretty unavoidable, and I think the software engineering community will actually start to get better at handling what happens when a widespread dependency needs to go on life support.

styfle 6y ago

There’s a lot of different metrics to look at when determining if one should install a dependency or not. One such metric I found to be missing for npm dependencies was the install size, which is why I created https://packagephobia.com https://packagephobia.com We need more tools to help make this decision because its easy to add a new dependency but its often hard to remove a dependency.

dakiol 6y ago
I'm not sure size is a good metric here. For example, a really tiny npm library like left pad (https://packagephobia.com/result?p=leftpad https://packagephobia.com/result?p=leftpad) is something you don't want to depend on (because you can implement it in a couple of lines), whereas date-fns (https://packagephobia.com/result?p=date-fns https://packagephobia.com/result?p=date-fns), which is way bigger than left pad, is a library I definitely don't mind depending on.
- styfle 6y ago
  That’s a great example! You looked at the size and determined that it might not be worth bringing on a small dependency when you can implement it yourself (or rather use String.prototype.padStart). It’s not just size alone but size of transitive dependencies. Both examples you gave don’t have any dependencies (the publish size matches the install size). Take a look at some popular dependencies like request or jest and notice the number of transitive dependencies. https://packagephobia.com/result?p=request https://packagephobia.com/result?p=request https://packagephobia.com/result?p=jest https://packagephobia.com/result?p=jest

dx87 6y ago

This trend towards huge dependency trees has started to turn me off getting serious about learning software development. It seems like unless you want to make a toy program, you end up with hundreds of dependencies, most of which are made by volunteers who could decide they don't feel like working on it any more. Even having someone paid to do the work doesn't seem like it matters anymore when you consider that Mozilla just laid off a bunch of technical employees to focus on whatever else. Are there any other solo devs who get "dependency anxiety" and don't want to start working on a project because you worry that you'll have wasted your time if one of the hundreds of dependencies breaks something, and there is nobody to fix it (like a crypto library for example)?

randall 6y ago
The flip side is 12 people could run Instagram before acquisition.
chadash 6y ago
I'm sorry to hear you feel afraid to learn more software development, but i think these concerns are largely unfounded. First of all, dependencies don't break just because they are unmaintained. If it worked ten years ago, it should still work now. For particularly complicated dependencies, there's a likelihood that they have bugs. But if they are popular, these bugs are often either things you probably won't ever come across or can work around if you do. Finally, the beauty of open source software is that you can fix things yourself! Found a package from 10 years ago that works 99% of the time, but you just need to fix one thing or add one tiny feature? Not a problem, you fork the repo and add what you need.
- fermienrico 6y ago
  > Finally, the beauty of open source software is that you can fix things yourself! Don't you need proper domain knowledge to hack into the some obscure error for svg conversion inside of cairo? All you were trying to do is to display the company logo.svg from your graphics department who exported it on Illustrator version 5.0 because our company is too poor to go to subscription model for Adobe. May be something goofy in the svg data. You spend next days fixing this open source package, ranting on stackoverflow and finally have to concede and file an bug report on Github. It gets rejected because you have not gathered all the necessary details to file a bug report including proper stack traces and operating system information.

dimitrios1 6y ago

This is describing cURL, isn't it?

gramakri 6y ago

ffmpeg comes to mind

dependenttypes 6y ago

ImageMagick is the ffmpeg of images.

RyanShook 6y ago

I’m constantly amazed by the quality and consistency of the open source community. Can you think of any other industry where massive companies are built on top of free infrastructure?

tamrix 6y ago
OpenSource software isn't free. It costs people's time to develop and maintain. Calling it 'free' devalues the projects and their maintainers by giving the impression their time isn't worth anything. We as the OpenSource community need to start moving towards a more sustainable approach to OpenSource development. First step: Stop calling it free.
- phist_mcgee 6y ago
  Oh god this is the same argument rolled out by opponents of socialised healthcare. If it's free then you are forcing the doctor to work for no pay! Stop splitting hairs over the meaning of 'free' in this context. It is free to the end user, it is not free to the developer or maintainer. I make christmas hampers for the poor, I call them free hampers. Of course they are not free, but to the end user they are. And no, people are not going to start using the word libre, it is not an English word and it is not used widely enough outside of computing and it will probably not catch on. /endrant
- jfax 6y ago
  I feel like calling Free software 'open source' devalues the project and their maintainers by giving the impression their work can be exploited for non-Free software.
- f1refly 6y ago
  Yes, I agree, open source software isn't free. Anyone can take it, close it off and steal the fruits of my work to do whatever with it. Calling it "free" devalues the projects and their maintainers by giving the impression they'd rather use a questionable license model than create software for humanity. We as the free software community need to show people who call it open source the door and have them escort out by security so they stop ruining the whole affair. ...what was that money thing you where rambling about?

aljgz 6y ago

Author of one such library faced serious problems. He has opened up yesterday in this blog post. https://medium.com/@behdadesfahbod/if-you-read-one-thing-from-me-please-be-this-2262ec7b8af2?source=friends_link&sk=e29ac54d3fbed71de045ed6a5857280b https://medium.com/@behdadesfahbod/if-you-read-one-thing-fro... His tweet: https://twitter.com/behdadesfahbod/status/1295326945178054659?s=20 https://twitter.com/behdadesfahbod/status/129532694517805465... The library: https://github.com/harfbuzz/harfbuzz https://github.com/harfbuzz/harfbuzz

cmrdporcupine 6y ago
Oh wow, he was at Google Waterloo when I first started and was a super nice guy. This is a hard and terrifying read. I really feel for him.
apta 6y ago
Who attempted to force his employer to fire him for a code of conduct violation?
- aljgz 6y ago
  I don't know what part of his story you refer to, if its: "It took me weeks to regain access to my accounts, which were disabled after my employer (Facebook) was notified and embarked on disabling them." I guess they've disabled his account to prevent access of the intelligence services to any sensitive data.
  - apta 6y ago
    It's there in the tweet he links: https://twitter.com/behdadesfahbod/status/1275131870036914177 https://twitter.com/behdadesfahbod/status/127513187003691417...
    - aljgz 6y ago
      I think it's an unrelated issue.
6y ago

Quarkonout 6y ago

A big part of Go's success is due to the large and useful standard lib. This kind of ecosystem feature is much more valuable than any language feature. If the Rust guys would understand this and put an async runtime, http server and client, crypto and some more essentials in the standard lib the adoption would be much higher. Than we would have a super robust language and a super robust ecosystem. I don't think the borrow checker is the issue with Rust slow adoption in the mainstream backend business.

majewsky 6y ago
I can't speak for the Rust devs, but as far as I'm aware, the longterm plan is to have more stuff in std, but only once they're fairly certain they have the right design. Async/await is a good example. The Rust community explored the design space for async runtimes for several years before they felt comfortable settling on a design for the initial pieces of std. The process is definitely frustratingly slow, but going faster has burned the Rust devs already in the past (just look at how much stuff in std::error::Error is deprecated).
- steveklabnik 6y ago
  The main problem isn't just that, it's that also, Rust cannot decide that a one-size-fits-all executor is the only one. Different properties are needed for different projects, and blessing any one executor cuts off all of the rest of them. Tokio is fantastic for web services, but is inappropriate for my microcontroller.
  - majewsky 6y ago
    Do you have a notification daemon for every HN comment that mentions Rust? :)
    - steveklabnik 6y ago
      Nope, just use the search bar.

cel1ne 6y ago

I wonder if you could write a program that scans javascript-dependencies for function-usage that could be replaced by suites like lodash, to find and replace "leftpad-style dependencies".

zzo38computer 6y ago

I don't use a lot of dependencies in my software (some uses none except the standard library, or for software that runs on a VM, the VM it runs on (although any implementation can be used)). (Probably the only program I do maintain that has too many dependencies is TeXnicard, because it depends on Ghostscript (which has a lot of dependencies). It also uses PCRE and SQLite3 (which are not so bad, since they don't have other dependencies).) In terms of ImageMagick, I used to use it but now maintain my own set of programs for dealing with picture files (almost entirely written in C, although the ones for converting to/from fax format are in PostScript; I may later write a version in C as well, so that you can use it if you do not have a PostScript interpreter). Like most software I write, I try to not use many dependencies if I can avoid it. (It doesn't use libpng either; it is using LodePNG, which is better in many ways, in my opinion.) (These set of programs I wrote also have many effects that I have not seen in other programs, such as automatic rearranging in a horizontal or vertical strip, removing duplicates from a vertical strip, and making the tensor product of two pictures. There are also file formats ImageMagick does not support.)

skapadia 6y ago

All I think of is Angry Birds when I see that picture...

commonturtle 6y ago

Very well put. I suspect this is one of those xkcd's that will become a timeless classic, just like the one on standards: https://xkcd.com/927/ https://xkcd.com/927/.

KyleBerezin 6y ago

Would you trust the stability of the dependency more if it was maintained by a large company, say, Oracle?