3 ms·
At my last company we had our own copy of every dependency we used, sometimes multiple versions. For a while every dependency had to get approved (someone would
by tracer4201 6y ago
At my last company we had our own copy of every dependency we used, sometimes multiple versions. For a while every dependency had to get approved (someone would literally look at the license and verify it’s in our company’s approved list of licenses). This was after a contractor used some dependency that he had written himself, left the company, and then tried to sue us.
But we never took a dependency on any external code repository. Imagine that external service goes down. Would you be able to afford having blocked builds?
- gervwyk 6y agoThat's a funny story. Yes, we also check licenses, security, popularity and maintainers before introducing a dependency. Then of course again track changes for every future release so there is a significant overhead to for every dependency. When you say never took on any external code repository does it mean you guys would make a copy of every package you add, build it yourself and not use something like npm dependencies in production?
- tracer4201 6y agoYes, exactly the latter. Our build system actually blocked any kind of network call to external services. Every dependency and transitive dependency was hosted in house.