3 ms·
Adding a package like this as a dependency is a net negative, because for the sake of trivial functionality you take on all the supply chain overhead and securi
by rectang 5y ago
Adding a package like this as a dependency is a net negative, because for the sake of trivial functionality you take on all the supply chain overhead and security risk.
The culture of relying on small dependencies needs to adapt to account for security. It's one of many aspects of open source supply chain management due for a reckoning.
- comeonseriously 5y agoBut DAMMIT, developer productivity, man! But, honestly, do developers these days just not have their OWN libraries of code they bring along with them? Are they SO dependent on others they can't write trivial code?
- toyg 5y agoI reckon that centralized package management actually _reduced_ the amount of people relying on their own library of snippets. Why bother saving how you solved Problem A, when there is probably a package doing it better...?