4 ms·

It's literally 5 lines of code. My question is always "why is this a dependency and not a Stack Overflow answer?" For anyone who imported this as a dependency,

It's literally 5 lines of code. My question is always "why is this a dependency and not a Stack Overflow answer?" For anyone who imported this as a dependency, why didn't you copy-paste the five lines into your code? I'm genuinely curious.

brightball 6y ago
This is always my question as well.
slooonz 6y ago
Do you also copy-paste the 36 lines of unit tests in your project ?
- marcus_holmes 6y ago
  No, I'd maybe run them once just to check it covers the corner-cases. The code is never going to change, because it's a polyfill for old browsers, and only needed for legacy environments that won't change. So if the tests pass once, they'll pass forever. There is literally no point in adding those tests to my test suite - there is no combination of changes that will ever make this fail if it passes once.
marketingPro 6y ago
I've wondered this too. I've seen someone make a COVID data library but I thought about how much more difficult it would be to learn the library instead of just importing and manipulating the data. My best thought is that it saves time to import, it saves visual lines which may make it easier to understand what is code ripe for modification and code that shouldn't be changed.
deleted 6y ago
[deleted]
ryandrake 6y ago
My response to that is, "Is your company really OK with copy-pasting from Stack Overflow into their production system?" Do you know what license the Stack Overflow content is released under [1]? Is that license compatible with your company's software? Are you complying with the terms of that license, including providing any required attribution? Who gets sued or fired if that copy-pasted code doesn't work? What goes into the post-mortem? Similarly, is your company really OK with you just pulling in a dependency and coding onward? Do you review each external dependency's license for compatibility with your company's software? Do you audit each dependency for security issues, backdoors, and other bugs? What dependencies do your dependencies rely on, and have you reviewed them, too? How do you know the dependency works as you think it should work? What is the maintenance plan for this dependency? How often do you plan to update the dependency, and when you do, do you plan to re-audit it? As someone who has worked on safety-critical marine and aerospace applications, this casual attitude about pulling in dependencies and copy-pasting code is so foreign to me! Is this yolo attitude really how it works in the move-fast-and-break-things universe? No large company I ever worked for would allow any of this without proper vetting and reviewing--even on non-safety-critical programs. Really interesting and scary how best practices are defined in various areas of the software development world! 1: https://stackoverflow.com/help/licensing https://stackoverflow.com/help/licensing
- marcus_holmes 6y ago
  It's 5 lines of code. Yes I'm fine with copy-pasting that into a production system. Yes I just reviewed it, by reading the 5 lines of code and deciding that they were OK to deploy to a production system. I totally get your point, though, and completely agree with you on more complex examples. I would not feel comfortable copy-pasting code into my system that I didn't understand or hadn't read through completely. And I avoid dependencies as much as possible.

brightball 6y ago

This is always my question as well.

slooonz 6y ago

Do you also copy-paste the 36 lines of unit tests in your project ?

marcus_holmes 6y ago
No, I'd maybe run them once just to check it covers the corner-cases. The code is never going to change, because it's a polyfill for old browsers, and only needed for legacy environments that won't change. So if the tests pass once, they'll pass forever. There is literally no point in adding those tests to my test suite - there is no combination of changes that will ever make this fail if it passes once.

marketingPro 6y ago

I've wondered this too. I've seen someone make a COVID data library but I thought about how much more difficult it would be to learn the library instead of just importing and manipulating the data. My best thought is that it saves time to import, it saves visual lines which may make it easier to understand what is code ripe for modification and code that shouldn't be changed.

deleted 6y ago

[deleted]

ryandrake 6y ago

My response to that is, "Is your company really OK with copy-pasting from Stack Overflow into their production system?" Do you know what license the Stack Overflow content is released under [1]? Is that license compatible with your company's software? Are you complying with the terms of that license, including providing any required attribution? Who gets sued or fired if that copy-pasted code doesn't work? What goes into the post-mortem? Similarly, is your company really OK with you just pulling in a dependency and coding onward? Do you review each external dependency's license for compatibility with your company's software? Do you audit each dependency for security issues, backdoors, and other bugs? What dependencies do your dependencies rely on, and have you reviewed them, too? How do you know the dependency works as you think it should work? What is the maintenance plan for this dependency? How often do you plan to update the dependency, and when you do, do you plan to re-audit it? As someone who has worked on safety-critical marine and aerospace applications, this casual attitude about pulling in dependencies and copy-pasting code is so foreign to me! Is this yolo attitude really how it works in the move-fast-and-break-things universe? No large company I ever worked for would allow any of this without proper vetting and reviewing--even on non-safety-critical programs. Really interesting and scary how best practices are defined in various areas of the software development world! 1: https://stackoverflow.com/help/licensing https://stackoverflow.com/help/licensing

marcus_holmes 6y ago
It's 5 lines of code. Yes I'm fine with copy-pasting that into a production system. Yes I just reviewed it, by reading the 5 lines of code and deciding that they were OK to deploy to a production system. I totally get your point, though, and completely agree with you on more complex examples. I would not feel comfortable copy-pasting code into my system that I didn't understand or hadn't read through completely. And I avoid dependencies as much as possible.