3 ms·
> You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it b
by whateveracct 5y ago
> You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled.
We're professionals - we in fact simply can do that with some elbow grease. Doesn't take a genius to understand how software is built.
- charcircuit 5y agoThere is too much information out there to know all of it. Sure everyone knows how to do it, but it's often not worth the time to do so.
- whateveracct 5y agoMy point is it's your collective job as a professional software dev shop to do so. It's a relatively fixed cost too - incrementally knowing your toolchain once you've done it the first time isn't that bad.
- kube-system 5y agoThe only professionals who actually do this are in heavily regulated industries that require it, which are often criticized as being stuck with "ancient tech". It seems there's currently two ways to tackle this issue: move fast and break things, or move slowly and don't break things.
- whateveracct 5y agoI'm not saying you need to audit every line of code. I'm saying it should be trivial to fork any dependency in your tree. Every project I've ever worked on has met this - but I'm a Nix guy.