3 ms·

The phenomenon you're discussing is part of a broader trend towards simplifying development and deployment by just vendoring all dependencies, dammit. Fewer dep

The phenomenon you're discussing is part of a broader trend towards simplifying development and deployment by just vendoring all dependencies, dammit. Fewer dependencies, fewer headaches, both for app makers and OS vendors. The sky didn't fall when Android stopped providing openssl and libstdc++ with the OS. Sharing centrally managed dependencies made some sense in the days of infrequently-updated boxed software, but now? Brute force has made the size advantage of sharing irrelevant. (People complain about Electron memory use, but still use it.) Security advantages? App makers are perfectly capable of shipping their own security updates now that we have cloud auto-updating whenever we want it. I just don't think that there's still a real technical case for Debian-style dependency sharing in general purpose operating systems and that we can save ourselves a lot of time and pain by getting out of our 1990s shared library mindset. and it's taken a lot of time and a lot of retirements to change this mentality.

lll-o-lll 2y ago
> App makers are perfectly capable of shipping their own security updates now that we have cloud auto-updating whenever we want it. A large third-party dependency chain is, in my opinion, the most problematic security risk in modern software. Secondly, automatic updates are how we got cloud-strike. I’m not advocating Debian style dependency sharing, but I am advocating for tight control and auditing over your dependency chain (which will mean building more in house). And allowing IT departments to control update rollouts.
0x000xca0xfe 2y ago
Centrally managed dependencies are invaluable for small/simpler apps. Not every program is backed by a company that provides continuous updates. And what happens if the updates stop? Yeah right you have a giant pile of half-broken, bug-ridden and outdated random libraries. I use some small Win32 and GTK+ utilities that weren't touched in years and they all just work, are nicely integrated into the system theme (even dark mode works without me lifting a finger) and use fresh and up-to-date dependencies courtesy of the OS.

lll-o-lll 2y ago

> App makers are perfectly capable of shipping their own security updates now that we have cloud auto-updating whenever we want it. A large third-party dependency chain is, in my opinion, the most problematic security risk in modern software. Secondly, automatic updates are how we got cloud-strike. I’m not advocating Debian style dependency sharing, but I am advocating for tight control and auditing over your dependency chain (which will mean building more in house). And allowing IT departments to control update rollouts.

0x000xca0xfe 2y ago

Centrally managed dependencies are invaluable for small/simpler apps. Not every program is backed by a company that provides continuous updates. And what happens if the updates stop? Yeah right you have a giant pile of half-broken, bug-ridden and outdated random libraries. I use some small Win32 and GTK+ utilities that weren't touched in years and they all just work, are nicely integrated into the system theme (even dark mode works without me lifting a finger) and use fresh and up-to-date dependencies courtesy of the OS.