3 ms·

I think it smells of the common trend in javascript to grab any old package and use it if it scratches an itch. look at lpad(and that debacle). back when i was

I think it smells of the common trend in javascript to grab any old package and use it if it scratches an itch. look at lpad(and that debacle). back when i was doing compiled stuff (well even now in scripted land) you'd look hard at whether or not you needed that dependency since every dependency is a liability. and of course you'd manage the dependencies by hand. kidsthesedaysgetoffmylawn

baz00 3y ago
That's most modern software development though. Drag any old shit off the internet, dependencies, malware and incompetence included, then execute it as some arbitrary user with full access to your mission critical data and an outbound network connection. Maybe if you're big enough to have a security or compliance guy they will at most want you to buy in something that does a half assed attempt at tracking dependencies after it's too late or intercepts traffic pointlessly on the way out crippling your business inconveniently sometimes. I tend to just use whatever Debian ships with package-wise when I'm doing something for my own purposes. People laugh at me. Their funeral.
pixl97 3y ago
Heh, it's fun doing SCA and SBOM these days and having the report generation break because the servers run out of ram building the list of everything the devs included. Then the dev team comes back and says it's impossible to run the application out of ram, they'd have to include thousands of modules and there is no way in hell you could keep that application working over time and manage to audit it. Then you show the devs the trace logs for the error and they shudder in terror.
- pxc 3y ago
  What are you using to generate SBOM these days?
spion 3y ago
This is due to a long time of the standard library being seriously lacking. Even today, group / groupToMap still aren't standardized, nor are iterator methods. It used to be even worse though.
- baz00 3y ago
  Very true. This is one thing I like about Go. The standard library is very complete. I can do most things I need to do without having to pull in any external dependencies.

baz00 3y ago

That's most modern software development though. Drag any old shit off the internet, dependencies, malware and incompetence included, then execute it as some arbitrary user with full access to your mission critical data and an outbound network connection. Maybe if you're big enough to have a security or compliance guy they will at most want you to buy in something that does a half assed attempt at tracking dependencies after it's too late or intercepts traffic pointlessly on the way out crippling your business inconveniently sometimes. I tend to just use whatever Debian ships with package-wise when I'm doing something for my own purposes. People laugh at me. Their funeral.

pixl97 3y ago

Heh, it's fun doing SCA and SBOM these days and having the report generation break because the servers run out of ram building the list of everything the devs included. Then the dev team comes back and says it's impossible to run the application out of ram, they'd have to include thousands of modules and there is no way in hell you could keep that application working over time and manage to audit it. Then you show the devs the trace logs for the error and they shudder in terror.

pxc 3y ago
What are you using to generate SBOM these days?

spion 3y ago

This is due to a long time of the standard library being seriously lacking. Even today, group / groupToMap still aren't standardized, nor are iterator methods. It used to be even worse though.

baz00 3y ago
Very true. This is one thing I like about Go. The standard library is very complete. I can do most things I need to do without having to pull in any external dependencies.