3 ms·
I agree that some amount of friction when including third party dependencies is a vital thing to push people to consider the value versus cost of dependencies (
by sunrunner 1y ago
I agree that some amount of friction when including third party dependencies is a vital thing to push people to consider the value versus cost of dependencies (and license review, code review, channel subscriptions are all incredibily important and almost always overlooked), however how should this work for transitive dependendencies? And the dependencies of _those_ dependencies?
The dependency trees for most interpreted or source-distributed languages are ridiculous, and review of even a few of those seems practically impossible in a lot of development environments.
- dsr_ 1y agoYou understand the problem clearly, but you haven't put your finger on the solution. It's an obvious one, but distasteful to many people.
- shwouchk 1y agoPerhaps the distaste is blinding me. Would you care to state the obvious very clearly, for the dense ones among us?
- dsr_ 1y ago"The dependency trees for most interpreted or source-distributed languages are ridiculous," Therefore, you must only use software for which the dependency trees are not ridiculous. And that means giving up on software with ridiculous dependencies.