3 ms·
These seem like two independent concerns: 1. How the dependencies are broken up 2. Whether to take dependencies at all ("buy or build") It's still not clear
by anonymars 1y ago
These seem like two independent concerns:
1. How the dependencies are broken up
2. Whether to take dependencies at all ("buy or build")
It's still not clear to me how taking a larger dependency (with things I might not need) is inherently better than taking smaller dependencies. That seems like a question of trade-offs. What if there's an issue or security hole in a portion of the larger dependency that I didn't even use? For example, that log4j LDAP debacle, what if that were broken down into smaller dependencies so that you didn't even have the LDAP thing if you weren't using it?