3 ms·
s/Best way/The only safe way/ Anything else will get abused in the name of expediency and just-this-one-time. Also, the process for adding a crate/gem/module/
by dsr_ 1y ago
s/Best way/The only safe way/
Anything else will get abused in the name of expediency and just-this-one-time.
Also, the process for adding a crate/gem/module/library needs to be the same as anything else: license review, code review, subscription to the appropriate mailing list or other announce channel, and assignment of responsibility. All of these except code review can be really, really fast once you have the process going.
All problems are, at least in part, dependency chain management problems.
- sunrunner 1y agoI agree that some amount of friction when including third party dependencies is a vital thing to push people to consider the value versus cost of dependencies (and license review, code review, channel subscriptions are all incredibily important and almost always overlooked), however how should this work for transitive dependendencies? And the dependencies of _those_ dependencies? The dependency trees for most interpreted or source-distributed languages are ridiculous, and review of even a few of those seems practically impossible in a lot of development environments.
- dsr_ 1y agoYou understand the problem clearly, but you haven't put your finger on the solution. It's an obvious one, but distasteful to many people.
- shwouchk 1y agoPerhaps the distaste is blinding me. Would you care to state the obvious very clearly, for the dense ones among us?
- dsr_ 1y ago"The dependency trees for most interpreted or source-distributed languages are ridiculous," Therefore, you must only use software for which the dependency trees are not ridiculous. And that means giving up on software with ridiculous dependencies.