4 ms·

I completely agree with you, but your last point is exactly why recent updates are a proxy for ‘well-maintained.’ Software is so complex that it _has_ to have d

I completely agree with you, but your last point is exactly why recent updates are a proxy for ‘well-maintained.’ Software is so complex that it _has_ to have dependencies, and even if you vendor them / compile to an executable, that doesn’t account for upstream bug or security fixes.

hsn915 5y ago
1) If you buy into this concept, you would naturally limit your dependencies to the bare minimum. 2) Static linking does a good job of protecting against when upstream introduces new bugs or security holes.
- chousuke 5y ago
  Static linking also protects you from security patches. I like writing low-dependency software, but what that means is that I pick a distribution to build on and use their packages. If a library is not packaged, it has to be really good for me to depend on it. Sure, it might break once in a blue moon depending on how stable the distribution you use is, and you'll need to refresh your stuff every 4-9 years when a new version of the base OS is released and the old one goes EOL, but most of the time the result will be extremely low-maintenance.
- sixstringtheory 5y ago
  > limit your dependencies to the bare minimum I get this desire, but likely it guarantees more work for yourself and probably more undiscovered bugs, because with only one set of eyes, to invert Linus’ law, many bugs may lurk deep.
  - hsn915 5y ago
    Have you actually tried to reduce dependencies? I mean, are you speaking from experience, or just theorizing? Here's something to keep in mind: when you depend on a huge library that has 40 features, it's likely your program only needs 5 of them. So, while the huge library benefits from "many eyes", your particular program would benefit much more from not depending on a library with a lot more features than you need. Also I don't know if you've seen how open source works, but chances are the number of people actively looking at the source code for these libraries to uncover bugs or security holes is very small to non-existent.
    - amw-zero 5y ago
      You don’t need to be condescending. We all know that using dependencies saves time, and it’s not possible to build any practical software without them. An OS is a dependency. A GUI library is a dependency. A database is a dependency. Sure, you can limit them, but you can’t live without them. That’s not theorizing, that’s the whole industry’s collective wisdom.
      - hsn915 5y ago
        What part of my comment was condescending? > That’s not theorizing, that’s the whole industry’s collective wisdom. There's no wisdom there. The industry is too young to have any meaningful wisdom to speak of. It's mostly fashion driven. > An OS is a dependency. A GUI library is a dependency. A database is a dependency. Well, I did make a distinction in my original post about stable dependencies, and I included the OS as a stable dependency. I also never said you should have "zero" dependencies. My point is about minimizing dependencies as much as you can.
        amw-zero 5y ago
        This was the condescending part: > Have you actually tried to reduce dependencies? > I mean, are you speaking from experience, or just theorizing?
        hsn915 5y ago
        Why is it condescending? I asked this question because your comment does not jive with my experience. So before countering your point I wanted to confirm whether you had some experience that was opposite to mine or not. Where is the condescension? In my mind I'm being polite and not making assumptions. If I wanted to be condescending I would tell you that you have no idea what you're talking about.
        speed_spread 5y ago
        TBH, opening your post with "Have you tried X?" _does_ read like a very short step from "you have no idea what you're talking about", whether you meant it like that or not.
umvi 5y ago
I disagree. How many times does software use 3rd party dependencies when the standard library would have sufficed with a bit of extra effort? With python, golang, and others the standard library should cover most cases
- amw-zero 5y ago
  Go is pretty darn good at avoiding breaking changes to the standard library. But, um, do you remember Python 3? You just proved my point with that one, in your own words.

hsn915 5y ago

1) If you buy into this concept, you would naturally limit your dependencies to the bare minimum. 2) Static linking does a good job of protecting against when upstream introduces new bugs or security holes.

chousuke 5y ago
Static linking also protects you from security patches. I like writing low-dependency software, but what that means is that I pick a distribution to build on and use their packages. If a library is not packaged, it has to be really good for me to depend on it. Sure, it might break once in a blue moon depending on how stable the distribution you use is, and you'll need to refresh your stuff every 4-9 years when a new version of the base OS is released and the old one goes EOL, but most of the time the result will be extremely low-maintenance.
sixstringtheory 5y ago
> limit your dependencies to the bare minimum I get this desire, but likely it guarantees more work for yourself and probably more undiscovered bugs, because with only one set of eyes, to invert Linus’ law, many bugs may lurk deep.
- hsn915 5y ago
  Have you actually tried to reduce dependencies? I mean, are you speaking from experience, or just theorizing? Here's something to keep in mind: when you depend on a huge library that has 40 features, it's likely your program only needs 5 of them. So, while the huge library benefits from "many eyes", your particular program would benefit much more from not depending on a library with a lot more features than you need. Also I don't know if you've seen how open source works, but chances are the number of people actively looking at the source code for these libraries to uncover bugs or security holes is very small to non-existent.
  - amw-zero 5y ago
    You don’t need to be condescending. We all know that using dependencies saves time, and it’s not possible to build any practical software without them. An OS is a dependency. A GUI library is a dependency. A database is a dependency. Sure, you can limit them, but you can’t live without them. That’s not theorizing, that’s the whole industry’s collective wisdom.
    - hsn915 5y ago
      What part of my comment was condescending? > That’s not theorizing, that’s the whole industry’s collective wisdom. There's no wisdom there. The industry is too young to have any meaningful wisdom to speak of. It's mostly fashion driven. > An OS is a dependency. A GUI library is a dependency. A database is a dependency. Well, I did make a distinction in my original post about stable dependencies, and I included the OS as a stable dependency. I also never said you should have "zero" dependencies. My point is about minimizing dependencies as much as you can.
      - amw-zero 5y ago
        This was the condescending part: > Have you actually tried to reduce dependencies? > I mean, are you speaking from experience, or just theorizing?
        hsn915 5y ago
        Why is it condescending? I asked this question because your comment does not jive with my experience. So before countering your point I wanted to confirm whether you had some experience that was opposite to mine or not. Where is the condescension? In my mind I'm being polite and not making assumptions. If I wanted to be condescending I would tell you that you have no idea what you're talking about.
        speed_spread 5y ago
        TBH, opening your post with "Have you tried X?" _does_ read like a very short step from "you have no idea what you're talking about", whether you meant it like that or not.

umvi 5y ago

I disagree. How many times does software use 3rd party dependencies when the standard library would have sufficed with a bit of extra effort? With python, golang, and others the standard library should cover most cases

amw-zero 5y ago
Go is pretty darn good at avoiding breaking changes to the standard library. But, um, do you remember Python 3? You just proved my point with that one, in your own words.