2 ms·
The nuance is: how much do you trust the package owners and their transitive dependencies to be: Secure Performant Non breaking etc. I would hesitate to im
by quickthrower2 3y ago
The nuance is: how much do you trust the package owners and their transitive dependencies to be:
Secure
Performant
Non breaking
etc.
I would hesitate to import a package for a one liner (a left pad for example) but happier to import a decent bunch of battle tested utils (date-fns, underscore, etc.)
Since each dep is a political org you need to trust, so I wanna get a decent amount of problems solved with that dep not just save a line of code.
- agloe_dreams 3y agounderscore is actually our latest casualty in the new tool. It is now generally recommended to do array functions using standard JS if your product system reqs mesh.
- thephyber 3y agoAgree that every dependency is a new org to trust. I’m very interested in ways to identify high quality+security libraries and orgs. Simply saying “I am willing to rewrite everything from scratch” doesn’t work. Finding the best way to work with the existing ecosystem is more or less a requirement for most companies/projects.