4 ms·

> limit your dependencies to the bare minimum I get this desire, but likely it guarantees more work for yourself and probably more undiscovered bugs, because w

> limit your dependencies to the bare minimum I get this desire, but likely it guarantees more work for yourself and probably more undiscovered bugs, because with only one set of eyes, to invert Linus’ law, many bugs may lurk deep.

hsn915 5y ago
Have you actually tried to reduce dependencies? I mean, are you speaking from experience, or just theorizing? Here's something to keep in mind: when you depend on a huge library that has 40 features, it's likely your program only needs 5 of them. So, while the huge library benefits from "many eyes", your particular program would benefit much more from not depending on a library with a lot more features than you need. Also I don't know if you've seen how open source works, but chances are the number of people actively looking at the source code for these libraries to uncover bugs or security holes is very small to non-existent.
- amw-zero 5y ago
  You don’t need to be condescending. We all know that using dependencies saves time, and it’s not possible to build any practical software without them. An OS is a dependency. A GUI library is a dependency. A database is a dependency. Sure, you can limit them, but you can’t live without them. That’s not theorizing, that’s the whole industry’s collective wisdom.
  - hsn915 5y ago
    What part of my comment was condescending? > That’s not theorizing, that’s the whole industry’s collective wisdom. There's no wisdom there. The industry is too young to have any meaningful wisdom to speak of. It's mostly fashion driven. > An OS is a dependency. A GUI library is a dependency. A database is a dependency. Well, I did make a distinction in my original post about stable dependencies, and I included the OS as a stable dependency. I also never said you should have "zero" dependencies. My point is about minimizing dependencies as much as you can.
    - amw-zero 5y ago
      This was the condescending part: > Have you actually tried to reduce dependencies? > I mean, are you speaking from experience, or just theorizing?
      - hsn915 5y ago
        Why is it condescending? I asked this question because your comment does not jive with my experience. So before countering your point I wanted to confirm whether you had some experience that was opposite to mine or not. Where is the condescension? In my mind I'm being polite and not making assumptions. If I wanted to be condescending I would tell you that you have no idea what you're talking about.
        speed_spread 5y ago
        TBH, opening your post with "Have you tried X?" _does_ read like a very short step from "you have no idea what you're talking about", whether you meant it like that or not.
        amw-zero 5y ago
        First, you weren’t condescending to me, you were condescending to someone else. Second, saying “you have no idea what you’re talking about” is aggressive, not condescending. “Have you actually tried X?” is condescending, because it places you in a position of superiority, framed as an “honest” question. If in your mind that is a polite and honest conversation, your mind is clouded, as me an other people have now let you know.
  - Jensson 5y ago
    But you can choose dependencies which has been stable for years. Like OS calls and libraries with a long stable track record. Those are good enough to be productive.
- sixstringtheory 5y ago
  Wow, so you ask me for credentials, accuse me of theorizing, and then by the time you finally get around to addressing my point, you hypocritically theorize with “it’s likely” and “chances are”! Well done, I’m not wasting my time on you just like I wouldn’t by rolling my own logging library for the umpteenth time. Good luck out there.
  - hsn915 5y ago
    I didn't ask you for credentials nor accuse you of anything. It was an honest question.
- gmfawcett 5y ago
  If you're sincerely interested in a thoughtful discussion, you should dial back the smug tone in your posts.

hsn915 5y ago

Have you actually tried to reduce dependencies? I mean, are you speaking from experience, or just theorizing? Here's something to keep in mind: when you depend on a huge library that has 40 features, it's likely your program only needs 5 of them. So, while the huge library benefits from "many eyes", your particular program would benefit much more from not depending on a library with a lot more features than you need. Also I don't know if you've seen how open source works, but chances are the number of people actively looking at the source code for these libraries to uncover bugs or security holes is very small to non-existent.

amw-zero 5y ago
You don’t need to be condescending. We all know that using dependencies saves time, and it’s not possible to build any practical software without them. An OS is a dependency. A GUI library is a dependency. A database is a dependency. Sure, you can limit them, but you can’t live without them. That’s not theorizing, that’s the whole industry’s collective wisdom.
- hsn915 5y ago
  What part of my comment was condescending? > That’s not theorizing, that’s the whole industry’s collective wisdom. There's no wisdom there. The industry is too young to have any meaningful wisdom to speak of. It's mostly fashion driven. > An OS is a dependency. A GUI library is a dependency. A database is a dependency. Well, I did make a distinction in my original post about stable dependencies, and I included the OS as a stable dependency. I also never said you should have "zero" dependencies. My point is about minimizing dependencies as much as you can.
  - amw-zero 5y ago
    This was the condescending part: > Have you actually tried to reduce dependencies? > I mean, are you speaking from experience, or just theorizing?
    - hsn915 5y ago
      Why is it condescending? I asked this question because your comment does not jive with my experience. So before countering your point I wanted to confirm whether you had some experience that was opposite to mine or not. Where is the condescension? In my mind I'm being polite and not making assumptions. If I wanted to be condescending I would tell you that you have no idea what you're talking about.
      - speed_spread 5y ago
        TBH, opening your post with "Have you tried X?" _does_ read like a very short step from "you have no idea what you're talking about", whether you meant it like that or not.
      - amw-zero 5y ago
        First, you weren’t condescending to me, you were condescending to someone else. Second, saying “you have no idea what you’re talking about” is aggressive, not condescending. “Have you actually tried X?” is condescending, because it places you in a position of superiority, framed as an “honest” question. If in your mind that is a polite and honest conversation, your mind is clouded, as me an other people have now let you know.
- Jensson 5y ago
  But you can choose dependencies which has been stable for years. Like OS calls and libraries with a long stable track record. Those are good enough to be productive.
sixstringtheory 5y ago
Wow, so you ask me for credentials, accuse me of theorizing, and then by the time you finally get around to addressing my point, you hypocritically theorize with “it’s likely” and “chances are”! Well done, I’m not wasting my time on you just like I wouldn’t by rolling my own logging library for the umpteenth time. Good luck out there.
- hsn915 5y ago
  I didn't ask you for credentials nor accuse you of anything. It was an honest question.
gmfawcett 5y ago
If you're sincerely interested in a thoughtful discussion, you should dial back the smug tone in your posts.