> 1a. As a consequence of (1) autogenerated artifacts should always be committed. I philosophically and fundamentally hate this suggestion, but have to agree w

> 1a. As a consequence of (1) autogenerated artifacts should always be committed. I philosophically and fundamentally hate this suggestion, but have to agree with it. It's going to make porting harder, but is sadly a cost worth paying. > dependencies are maintenance burden and a security risk, this needs to be weighted against the functionality they bring in Tough call. A major library is more likely to be bug fixed and tuned than something you write (which is a good reason to use them which is what makes them attractive as an attack vector). Getting this right requires taste and experience. The comment says "depending on large libraries for small amounts of functionality [is bad but thought to be good]". What constitutes "small amount" vs large requires experience. Certainly cases of this tip my bias towards re-implement vs re-use.