2 ms·

Because C does not have package managers. We were copy pasting libraries as .h files in our projects and never updating them.

taneq 4y ago
I still find it mind boggling that businesses have build processes for their core properties that rely on pulling hugs swathes off third party code in from the internet. How can that ever possibly be secure and robust?
- gw99 4y ago
  It’s even scarier when you actually sit down and review some of the code you’ve been importing for years… It has resulted in a major thinking shift for me. Mostly initiated by a malicious nodejs package being quietly pulled in.
  - jrib 4y ago
    Is there a language ecosystem you prefer now?
    - gw99 4y ago
      I mostly write stuff in Go with no imports at all now. It’s just that and stock vim on macOS is my entire stack. I am fortunate that my own contributions only require that.
- wongarsu 4y ago
  Had they written all the dependencies themselves, would they have been as secure and robust? The tradeoff isn't simple, and will be different for each company. I think everyone can point at a couple of components that are complex and massively benefit from the work poured into them and the large install base finding all the edge cases. Equally everyone can name a couple of dependencies that anyone could rewrite in a couple hours, and maybe even improve on the way.
  - taneq 4y ago
    Maybe, maybe not, but they certainly wouldn’t have included as many widespread, well known vulnerabilities with exploits already in the wild. And even if the imported code was perfect at the time it was imported, pulling in changes automatically is still an attack vector that you could drive a fleet of buses through. Note that I’m not saying “never use libraries”, which your points seem mainly aimed at. Code reuse is great! I’m just not sold on automatic, unmonitored updates to libraries.
DrBazza 4y ago
Same with C++. Dependencies were boost, qt, gtk, and a few others and that was pretty much it. Since vcpkg, cmake, conan, and a few others, the C++ "ecosystem" has started growing far more in the last 10 years, than in the previous 20.
- Ekaros 4y ago
  Is the modern tooling to blame for? It didn't use to be so simple that everything could be automatically updated or pulled. Had to actually go out and see what you were brining in and maybe even take a look in documentation or dates of last update.
  - DrBazza 4y ago
    I don't think there's one real reason but a combination, but I can list the features that C# and Java ecosystems had since the early 00s, and javascript/Rust have since they came around, but C++ hasn't had until recently. 1. one or more major package hubs 2. one package manager, or at least, a package standard 3. easy to consume/build (source code to binary) 4. easy to publish 5. easy to download (one liner in your build script, e.g. package.json, vcproj, cargo.toml, build.gradle etc.) At the moment C++ only really has 5. - easy to download: cmake, conan, vcpkg, build2, can all download easily. 1-4 are a work in progress for C++, but are far better than 10 years ago.
Ygg2 4y ago
Looking at https://wiki.alopex.li/LetsBeRealAboutDependencies https://wiki.alopex.li/LetsBeRealAboutDependencies Perhaps the reason is package managers for C are called distro maintainers (for Linux/BSD)

taneq 4y ago

I still find it mind boggling that businesses have build processes for their core properties that rely on pulling hugs swathes off third party code in from the internet. How can that ever possibly be secure and robust?

gw99 4y ago
It’s even scarier when you actually sit down and review some of the code you’ve been importing for years… It has resulted in a major thinking shift for me. Mostly initiated by a malicious nodejs package being quietly pulled in.
- jrib 4y ago
  Is there a language ecosystem you prefer now?
  - gw99 4y ago
    I mostly write stuff in Go with no imports at all now. It’s just that and stock vim on macOS is my entire stack. I am fortunate that my own contributions only require that.
wongarsu 4y ago
Had they written all the dependencies themselves, would they have been as secure and robust? The tradeoff isn't simple, and will be different for each company. I think everyone can point at a couple of components that are complex and massively benefit from the work poured into them and the large install base finding all the edge cases. Equally everyone can name a couple of dependencies that anyone could rewrite in a couple hours, and maybe even improve on the way.
- taneq 4y ago
  Maybe, maybe not, but they certainly wouldn’t have included as many widespread, well known vulnerabilities with exploits already in the wild. And even if the imported code was perfect at the time it was imported, pulling in changes automatically is still an attack vector that you could drive a fleet of buses through. Note that I’m not saying “never use libraries”, which your points seem mainly aimed at. Code reuse is great! I’m just not sold on automatic, unmonitored updates to libraries.

DrBazza 4y ago

Same with C++. Dependencies were boost, qt, gtk, and a few others and that was pretty much it. Since vcpkg, cmake, conan, and a few others, the C++ "ecosystem" has started growing far more in the last 10 years, than in the previous 20.

Ekaros 4y ago
Is the modern tooling to blame for? It didn't use to be so simple that everything could be automatically updated or pulled. Had to actually go out and see what you were brining in and maybe even take a look in documentation or dates of last update.
- DrBazza 4y ago
  I don't think there's one real reason but a combination, but I can list the features that C# and Java ecosystems had since the early 00s, and javascript/Rust have since they came around, but C++ hasn't had until recently. 1. one or more major package hubs 2. one package manager, or at least, a package standard 3. easy to consume/build (source code to binary) 4. easy to publish 5. easy to download (one liner in your build script, e.g. package.json, vcproj, cargo.toml, build.gradle etc.) At the moment C++ only really has 5. - easy to download: cmake, conan, vcpkg, build2, can all download easily. 1-4 are a work in progress for C++, but are far better than 10 years ago.

Ygg2 4y ago

Looking at https://wiki.alopex.li/LetsBeRealAboutDependencies https://wiki.alopex.li/LetsBeRealAboutDependencies Perhaps the reason is package managers for C are called distro maintainers (for Linux/BSD)