4 ms·

When I’m feeling the most cranky and pessimistic, I feel like we’re a long ways from escaping this vulnerability. It seems to me that we hit an enormous growth

When I’m feeling the most cranky and pessimistic, I feel like we’re a long ways from escaping this vulnerability. It seems to me that we hit an enormous growth phase in the last 10 years and invited upon ourselves an Eternal September of Bootcampers and other very green developers who can’t be trusted to do more than glue components together. Convenient, centralized package managers make these folk way more effective at delivering products in the near term, but there are too few experienced leads around to point out the maintenance and security concerns that play out long-term when you’ve committed yourself to continuously folding in unreviewed code from 1000 unpaid contributors you never vetted and who know nothing about you. After years of “screaming into the void” (as another commenter put it), I’ve accepted that this is reality and that there are reasons for it: it produces valuable work quickly, and remediates labor pressure by lowing the barrier to entry. But I can’t shake that we’ve loaded ourselves on a train whose track runs right over a cliff and that the correction, if it happens before we fall off that cliff, will be very expensive and jarring.

saidajigumi 5y ago
To a large extent, I think this is the nigh-inevitable outcome of the corporate world's entire take on open source. Open source has been a hugely successful way of distributing code cost centers, which is how we got here. Yet as many have noted, there's no social or economic model for supporting that work much less paying down its tech debt. Beyond a few Major Frameworks with substantial corporate backing, it's pretty grim. As an aside, I'm not about to blame folks who came up through bootcamps. I've known too many outstanding devs from those backgrounds, and it's clearly enabled many solid devs to enter the field who would otherwise have been excluded. (I've also met a lot of folks with CS degrees who could give fck all about critical code infrastructure concerns.) Likewise, for decades we've been striving to build languages, platforms, and tools that support powerful abstraction and code reuse. Somewhat amazingly to me, we've realized some of those goals. So I think the problem also isn't devs working at "glue code" level – at some point we must* work at higher abstractions to get useful work done. Reinventing the wheel (or $datastructure) gets old. Again, I'd return to noting that the foundations are rotten, and the age-old bugbear of complexity management has only gotten worse.
bob1029 5y ago
> I feel like we’re a long ways from escaping this vulnerability. I both agree and disagree with this in some ways. I think the potential to escape is better than ever before. The concern is more about the culture and the people for me. We have a very minimal vendor footprint with our B2B banking product (out of regulatory & market necessity). The only 3rd party software we depend upon aside from Microsoft's .NET framework stack is currently sqlite. For web-facing properties, we mostly just roll vanilla javascript. The latest web standards are incredible and you are really doing yourself a disservice by hiding from what is sitting out on MDN right now. We don't even need to use crap like jquery anymore. You are right about the "Eternal September of Bootcampers". Even guiding some curious friends down the path I was unable to keep them away from the dark alley peddlers of quick fixes and other ready-made software.

saidajigumi 5y ago

To a large extent, I think this is the nigh-inevitable outcome of the corporate world's entire take on open source. Open source has been a hugely successful way of distributing code cost centers, which is how we got here. Yet as many have noted, there's no social or economic model for supporting that work much less paying down its tech debt. Beyond a few Major Frameworks with substantial corporate backing, it's pretty grim. As an aside, I'm not about to blame folks who came up through bootcamps. I've known too many outstanding devs from those backgrounds, and it's clearly enabled many solid devs to enter the field who would otherwise have been excluded. (I've also met a lot of folks with CS degrees who could give fck all about critical code infrastructure concerns.) Likewise, for decades we've been striving to build languages, platforms, and tools that support powerful abstraction and code reuse. Somewhat amazingly to me, we've realized some of those goals. So I think the problem also isn't devs working at "glue code" level – at some point we must* work at higher abstractions to get useful work done. Reinventing the wheel (or $datastructure) gets old. Again, I'd return to noting that the foundations are rotten, and the age-old bugbear of complexity management has only gotten worse.

bob1029 5y ago

> I feel like we’re a long ways from escaping this vulnerability. I both agree and disagree with this in some ways. I think the potential to escape is better than ever before. The concern is more about the culture and the people for me. We have a very minimal vendor footprint with our B2B banking product (out of regulatory & market necessity). The only 3rd party software we depend upon aside from Microsoft's .NET framework stack is currently sqlite. For web-facing properties, we mostly just roll vanilla javascript. The latest web standards are incredible and you are really doing yourself a disservice by hiding from what is sitting out on MDN right now. We don't even need to use crap like jquery anymore. You are right about the "Eternal September of Bootcampers". Even guiding some curious friends down the path I was unable to keep them away from the dark alley peddlers of quick fixes and other ready-made software.