2 ms·
I’m constantly amazed at how careless developers are with pulling 3rd party libraries into their code. Have you audited this code? Do you know everything it doe
by ryandrake 2y ago
I’m constantly amazed at how careless developers are with pulling 3rd party libraries into their code. Have you audited this code? Do you know everything it does? Do you know what security vulnerabilities exist in it? On what basis do you trust it to do what it says it is doing and nothing else?
But nobody seems to do this diligence. It’s just “we are in a rush. we need X. dependency does X. let’s use X.” and that’s it!
- ClumsyPilot 2y ago> Have you audited this code? Wrong question. “Are you paid to audit this code?” And “if you fail to audit this code, who’se problem is it?”
- ryandrake 2y agoI think developers are paid to competently deliver software to their employer, and part of that competence is properly vetting the code you are delivering. If I wrote code that ended up having serious bugs like crashing, I’d expect to have at least a minimum consequence, like root causing it and/or writing a postmortem to help avoid it in the future. Same as I’d expect if I pulled in a bad dependency.
- baumy 2y agoYour expectations do not match the employment market as I have ever experienced it. Have you ever worked anywhere that said "go ahead and slow down on delivering product features that drive business value so you can audit the code of your dependencies, that's fine, we'll wait"? I haven't.
- ryandrake 2y agoYea, and that’s the problem. If such absolute rock bottom minimal expectations (know what the code does) are seen as too slow and onerous, the industry is cooked!
- ClumsyPilot 2y agoYeah, about that, businesses are pushing and introducing code written by AI/LLM now, so now you won't even know what your own code does.
- deleted 2y ago[deleted]
- djeastm 2y agoDue diligence is a sliding scale. Work at a webdev agency is "get it done as fast as possible for this MVP we need". Work at NASA or a biomedical device company? Every line of code is triple-checked. It's entirely dependent on the cost/benefit analysis.
- Funes- 2y ago"who'se" is wild.
- SoftTalker 2y agoIf a car manufacturer sources a part from a third party, and that part has a serious safety problem, who will the customer blame? And who will be responsible for the recall and the repairs?
- ClumsyPilot 2y agoBut we aren’t car business, am we are in joker business. When was the last time producer of an app was held legally accountable for negligence, had to pay compensation and damages, etc?