3 ms·

If you don't have automated management, you will probably not regularly check for updates on every one of dozens of dependencies manually.

cxr 3y ago
Sorry, what? I genuinely can't understand what you're saying/talking about.
- reactordev 3y ago
  There's a John Cleese quote that comes to mind. What they are saying is, if your dependencies are manually checked in, are you going to be on top of keeping them up to date for all the sev-1 CVE's that are found? Patches that are backported? Bugs that are fixed? And keep them all in sync? If your answer is yes to any of these, go look up the John Cleese quote. That is, unless you have an army of devs and maintainers to do it and get paid for it (hi Red Hat!).
  - cxr 3y ago
    > if your dependencies are manually checked in, are you going to be on top of keeping them up to date for all the sev-1 CVE's that are found? Patches that are backported? Bugs that are fixed? And keep them all in sync? Compared. To. What? (Alternatively: "uh... yes?") This is something like the third time that I've had to confront a comment alluding to the idea that having dependencies checked in to your repo means that updating them becomes, through some unspecified means, extremely difficult. And not just difficult, but intractably difficult. How exactly? Who knows—I've asked, but all I get are the same sort of continual allusions, as if it's some forgone conclusion on which there is common agreement, or it's a self-evident truth or something, but the actual thought process behind the remarks remain as impenetrable as the first time it was said. Please show your work. Please. What precisely is the mechanism by which this this is supposed to happen and that forms the basis for your position? What two things precisely are you comparing to one another? Be specific. Don't be vague. This conversation shouldn't be this exasperatingly difficult to have.
    - reactordev 3y ago
      [flagged]
      - dang 3y ago
        Whoa - you can't attack another user like that, no matter how wrong they are or you feel they are. We ban accounts that do this. Moreover we've had to warn you at least once before: https://news.ycombinator.com/item?id=25772871 https://news.ycombinator.com/item?id=25772871.
    - eternityforest 3y ago
      The precise mechanism is that if your update mechanism involves a manual step per-dependency(You have manually copied and pasted things into your repo), then the time needed to check for updates will scale with the number of dependencies. Manually checking all of them to even see what has updates available will take at least 10 to 20 minutes searching one by one. Likely up to several hours, even at 30 seconds per manual check. The odds that laziness or tight schedules will take over and nobody ever actually does this are higher. If one does actually do this, then they will be wasting 20 minutes regularly.
      - cxr 3y ago
        > The precise mechanism is that if your update mechanism involves a manual step per-dependency(You have manually copied and pasted things into your repo), then the time needed to check for updates will scale with the number of dependencies. I don't know what you're referring to. The resolution up for debate is "Dependencies belong in version control". You seem to be having a totally different conversation (where you "manually copied and pasted things into your repo"). What "Dependencies belong in version control" means is: - DO NOT add them to .gitignore. - DO `git add` them just like any other code. Updating things doesn't change; you update the packages that you depend on the same way you do if you aren't checking your dependencies in—e.g. by running `npm update` (or whatever).
        eternityforest 3y ago

cxr 3y ago

Sorry, what? I genuinely can't understand what you're saying/talking about.

reactordev 3y ago
There's a John Cleese quote that comes to mind. What they are saying is, if your dependencies are manually checked in, are you going to be on top of keeping them up to date for all the sev-1 CVE's that are found? Patches that are backported? Bugs that are fixed? And keep them all in sync? If your answer is yes to any of these, go look up the John Cleese quote. That is, unless you have an army of devs and maintainers to do it and get paid for it (hi Red Hat!).
- cxr 3y ago
  > if your dependencies are manually checked in, are you going to be on top of keeping them up to date for all the sev-1 CVE's that are found? Patches that are backported? Bugs that are fixed? And keep them all in sync? Compared. To. What? (Alternatively: "uh... yes?") This is something like the third time that I've had to confront a comment alluding to the idea that having dependencies checked in to your repo means that updating them becomes, through some unspecified means, extremely difficult. And not just difficult, but intractably difficult. How exactly? Who knows—I've asked, but all I get are the same sort of continual allusions, as if it's some forgone conclusion on which there is common agreement, or it's a self-evident truth or something, but the actual thought process behind the remarks remain as impenetrable as the first time it was said. Please show your work. Please. What precisely is the mechanism by which this this is supposed to happen and that forms the basis for your position? What two things precisely are you comparing to one another? Be specific. Don't be vague. This conversation shouldn't be this exasperatingly difficult to have.
  - reactordev 3y ago
    [flagged]
    - dang 3y ago
      Whoa - you can't attack another user like that, no matter how wrong they are or you feel they are. We ban accounts that do this. Moreover we've had to warn you at least once before: https://news.ycombinator.com/item?id=25772871 https://news.ycombinator.com/item?id=25772871.
  - eternityforest 3y ago
    The precise mechanism is that if your update mechanism involves a manual step per-dependency(You have manually copied and pasted things into your repo), then the time needed to check for updates will scale with the number of dependencies. Manually checking all of them to even see what has updates available will take at least 10 to 20 minutes searching one by one. Likely up to several hours, even at 30 seconds per manual check. The odds that laziness or tight schedules will take over and nobody ever actually does this are higher. If one does actually do this, then they will be wasting 20 minutes regularly.
    - cxr 3y ago
      > The precise mechanism is that if your update mechanism involves a manual step per-dependency(You have manually copied and pasted things into your repo), then the time needed to check for updates will scale with the number of dependencies. I don't know what you're referring to. The resolution up for debate is "Dependencies belong in version control". You seem to be having a totally different conversation (where you "manually copied and pasted things into your repo"). What "Dependencies belong in version control" means is: - DO NOT add them to .gitignore. - DO `git add` them just like any other code. Updating things doesn't change; you update the packages that you depend on the same way you do if you aren't checking your dependencies in—e.g. by running `npm update` (or whatever).
      - eternityforest 3y ago