3 ms·

I frequently push back on these complaints. Does the library you pulled in to manipulate an array polyfill newer array prototype functions? If so it likely fix

I frequently push back on these complaints. Does the library you pulled in to manipulate an array polyfill newer array prototype functions? If so it likely fixes issues in older browsers. Does the library get tested by a much larger QA / QE user base than your ad hoc code? Importing a library might benefit you from not having to reinvent the wheel. Does the library have unit tests and documentation? That is likely less work for your team to deal with bugs and maintenance. In practical terms, I doubt I have ever written a line of code that nobody else in the world has written. In that sense, I know that my value to my company is to judiciously choose when to write code in-house and when to import. And the heuristic is way different than what you describe.

quickthrower2 3y ago
The nuance is: how much do you trust the package owners and their transitive dependencies to be: Secure Performant Non breaking etc. I would hesitate to import a package for a one liner (a left pad for example) but happier to import a decent bunch of battle tested utils (date-fns, underscore, etc.) Since each dep is a political org you need to trust, so I wanna get a decent amount of problems solved with that dep not just save a line of code.
- agloe_dreams 3y ago
  underscore is actually our latest casualty in the new tool. It is now generally recommended to do array functions using standard JS if your product system reqs mesh.
- thephyber 3y ago
  Agree that every dependency is a new org to trust. I’m very interested in ways to identify high quality+security libraries and orgs. Simply saying “I am willing to rewrite everything from scratch” doesn’t work. Finding the best way to work with the existing ecosystem is more or less a requirement for most companies/projects.
agloe_dreams 3y ago
I definitely think my comment lacked a bit of nuance that may have come off as a blanket statement, sorry about that. My focus was on the types of poorly thought out package choices without the very care you are explaining. We would never reinvent rxjs, most tailwind plugins, or a key example of what you are explaining: Angulartics2. But on the other hand, my example here is closer to some packages that have zero user base or are, in themselves, a reimplementation. The angular Material example is that we already have a design system with buttons that is heavily documented and tested, it would have been less work than dealing with the package to just read the documentation or ask questions.

quickthrower2 3y ago

The nuance is: how much do you trust the package owners and their transitive dependencies to be: Secure Performant Non breaking etc. I would hesitate to import a package for a one liner (a left pad for example) but happier to import a decent bunch of battle tested utils (date-fns, underscore, etc.) Since each dep is a political org you need to trust, so I wanna get a decent amount of problems solved with that dep not just save a line of code.

agloe_dreams 3y ago
underscore is actually our latest casualty in the new tool. It is now generally recommended to do array functions using standard JS if your product system reqs mesh.
thephyber 3y ago
Agree that every dependency is a new org to trust. I’m very interested in ways to identify high quality+security libraries and orgs. Simply saying “I am willing to rewrite everything from scratch” doesn’t work. Finding the best way to work with the existing ecosystem is more or less a requirement for most companies/projects.

agloe_dreams 3y ago

I definitely think my comment lacked a bit of nuance that may have come off as a blanket statement, sorry about that. My focus was on the types of poorly thought out package choices without the very care you are explaining. We would never reinvent rxjs, most tailwind plugins, or a key example of what you are explaining: Angulartics2. But on the other hand, my example here is closer to some packages that have zero user base or are, in themselves, a reimplementation. The angular Material example is that we already have a design system with buttons that is heavily documented and tested, it would have been less work than dealing with the package to just read the documentation or ask questions.