3 ms·
The subtle nature of this topic drives this rule of thumb for me: Carefully consider each dependency you use, and if you need it. In Python, JS, and to a lesser
by the__alchemist 6y ago
The subtle nature of this topic drives this rule of thumb for me: Carefully consider each dependency you use, and if you need it. In Python, JS, and to a lesser extent Rust, it's common for articles to recommend dependencies to do things that can be done in a similar fashion without. This seems harmless at first, but leads to the problems described in the article, especially as the number of dependencies increases.
Another guideline: Avoid dependencies that have many dependencies of their own.
- majkinetor 6y ago> Carefully consider each dependency you use, and if you need it.... Avoid dependencies that have many dependencies of their own. Good luck with nodejs apps :-) "Carefully considered EACH dependency recursively" is not actionable advice (and nothing worst then tautology). I rely on automatic tests and penetration tests. The actionable advice is more like: Carefully consider if you need dependency. When you choose to use them, don't spend more then a dozen of minutes analyzing them internally but rely on automatic tests.
- grey-area 6y agoOr don’t use nodejs because of the culture of extensive dependencies it encourages.
- cjaybo 6y agoThis sounds awfully hand-wavy to me. What sort of tests do you write that take allow you to forego vetting dependencies yourself? You mention penetration tests here (?), are those really less time consuming and more effective than taking 30 minutes to review a library?
- majkinetor 6y agoYeah, they are. Recursive checking of libs as suggested doesn't take 30 minutes, or otherwise nobody would complain. And what if you missed something because nobody checks thoroughly the library code in 30 minutes - one will certainly obfuscate any malicious procedure. Also you can outsource the tests and its easy to do. Depending on the contract, they can even be held liable if you come to get owned via the method that should have been tested.
- darkhorse13 6y ago>Avoid dependencies that have many dependencies of their own. While I agree with you, good luck with that if you are using node/npm.