8 ms·

NIH is cheaper than the wrong dependency

310 points by todsacerdoti 1y ago

KingOfCoders 1y ago
With AI NIH will be the new normal.
- WalterGR 1y ago
  Why not ask AI how to use <appropriate library / framework> to implement <thing>? Doesn’t seem like you can blame NIH on AI more than other motivations for NIH. Edit to add: If AI makes NIH easier, then it implies that AI is good at solving problems, and speaks to AI’s credit.
  - KingOfCoders 1y ago
    From me using Claude Code, without a proper system prompt, Claude generates code rather than using a library, this week e.g. command line parameter and flag parsing. The difficulty is where the tipping point is to use a library, it can't be https://www.npmjs.com/package/is-even https://www.npmjs.com/package/is-even
- BigJono 1y ago
  I wish. As far as I can tell the Venn diagram of people building piles of shit with NPM and people building piles of shit with LLMs seems pretty close to a circle.
barisozmen 1y ago
Completely agree. It's one of the most important skills to know which dependency is good and which is bad. My two cents. If a dependency is paid, than it is usually bad. Because the company providing that dependency has an incentive to lock you in. As another point, "dependency minimalism" is a nice name for it. https://x.com/VitalikButerin/status/1880324753170256005 https://x.com/VitalikButerin/status/1880324753170256005
- ehnto 1y ago
  As well, paid dependencies usually only have one source of support, and when the company goes under or stops supporting the product you are in rough seas. Given very few companies last forever, you have to assess if the trajectory of your project would be impacted by being coupled to their ability to support you.
  - barisozmen 1y ago
    Exactly. That's another point
  - swiftcoder 1y ago
    > when the company goes under or stops supporting the product Or, even worse, gets acquired by someone like Salesforce
  - Cthulhu_ 1y ago
    For sure, this goes into the terrain of acquisition though, for which there are long-running procedures and assessment criteria. Long-term support / company longevity is one of them. But likewise, these companies have the incentive to look like they have long-running success and can be relied upon for years / decades to come.
- AdieuToLogic 1y ago
  > My two cents. If a dependency is paid, than it is usually bad. Because the company providing that dependency has an incentive to lock you in. Vendor lock-in is a risk for both purchased components and FOSS ones where the organization is unwilling to assume maintenance. The onus is on the team incorporating third-party component(s) to manage their risk, identify alternatives as appropriate, and modularize their solutions.
- 7402 1y ago
  If a dependency is paid and it is bad, then maybe you just aren't paying enough for it. If my code has a dependency then I want there to be people whose feel it is their job to support it. Either there have to be enough people who are paid to support it, or there have to be enough people whose self-worth and identity is so wrapped up in the code that they take it as a point of honor to support it. I don't need a company that's likely to abandon a code product and leave me hanging. I also don't need a free software author who says "bugs are not my problem - you have the source, go fix it yourself." If those are my choices, I'd rather write it myself.
barisozmen 1y ago
"One technique for making software more robust is to minimize what your software depends on – the less that can go wrong, the less that will go wrong. Minimizing dependencies is more nuanced than just not depending on System X or System Y, but also includes minimizing dependencies on features of systems you are using." From http://nathanmarz.com/blog/principles-of-software-engineering-part-1.html http://nathanmarz.com/blog/principles-of-software-engineerin...
skydhash 1y ago
A good question I ask myself is: Can I vendor it in? If I cannot, that’s usually something standard, but also a complex domain (crypto, network protocol, platform framework,…). Anything else, I assume it’s only a short term gain, so I make sure to explore the library and get a good understanding of its internals.
- betaby 1y ago
  Vendoring is somewhat an answer, but not always. I have some python code, vitrualenv is an obvious solution. However, older modules depend on older python3.9 behavior. And python 3.9 EOL is October 2025.
  - skydhash 1y ago
    Vendoring is taking the responsibility to maintain it as part of your codebase instead of relying on third party, not just capturing a snapshot.
  - eviks 1y ago
    What's the difference vs a state where you wrote the code many years ago that defends on 3.9?
- 3eb7988a1663 1y ago
  I am failing to find it, but Simon Willison had a post where he vendored some small (<1000 line) blob of code instead of adding it as a dependency. The trick was that he had some Github action(?) automation which would automatically check if the vendored version ever fell out of sync with upstream. Get the benefits of vendoring while minimizing your actual support burden. Only a realistic strategy for small bits of code, but I have considered do the same for a few utility libraries which are a focused niche, but subtle enough that you would rather outsource the complexity.
kazinator 1y ago
Note that the ECMA-48 escape sequences themselves are the good dependency, not abstractions that hide them, like your tput command or curses or what have you.
- bubblyworld 1y ago
  I think the OP's article is saying that they are both good and bad depending on the context. You need to evaluate these things on a case by case basis. Writing a little TUI for yourself or your team? Sure, go nuts with escape codes. Making a well supported tool that runs on any developer's machine? Maybe consider curses, there are probably more edge cases than you think. Trying to find product market fit as a startup? Who gives a duck, find some customers before you care too much about the tech =P cattle not pets etc
zdw 1y ago
The ubiquity criteria also informs scaling - for example, if a tooling or backend dependency is being production deployed by a company at a scale of 10^2 or 10^3 times your use case, you're much less likely to hit insurmountable performance issues until you get to similar scale. They're also much more likely to find/fix bugs affecting that scale earlier than you do, and many companies are motivated to upstream those fixes.
- moron4hire 1y ago
  I don't agree. Some of the worst bugs I've hit have been in libraries written by very large companies, supposedly "the best and brightest" (Meta, Google, Microsoft, in that order) but it takes forever for them to respond to issues. Some issues go on for years. I've spent months working in issue trackers discussing PRs and whether or not we can convince some rules-lawyer it doesn't warrant a spec change (HINT: you never convince him), chasing that "it's faster/cheaper/easier to use a 3rd party package" dragon, only to eventually give up, write my own solution, fix the core issue, and do it in less time than I've already wasted. And probably improve overall performance while I'm at it. I think a lot of it depends on the exact field you're working in. If you're working in anything sniffing close to consulting, work is a constant deluge of cockamamie requests from clients who don't understand they aren't paying you enough to throw together a PhD research thesis in a month with a revolving crew of junior developers you can't grow and keep because the consulting firm won't hire enough people with any amount of experience to give the small handful of senior developers they keep dragging into every God damned meeting in the building so we can have a chance to come up for air every once in a while. I'm at a point where I have enough confidence in my skills as a software developer that I know pretty much for certain whether I can develop a given solution. There are very few I can't. I'm not going to try to train an AI model on my own. I won't try to make my own browser. A relational database with all the ACID trimmings, no. But I'll definitely bang out my own agentic system running off of local inference engines. I'll for sure implement an offline HTML rendering engine for the specific reports I'm trying export to an image. I'll build a fugging graph database from scratch because apparently nobody can make one that I can convince anyone to pay for (budget: $0) that doesn't shit the bed once a week. Most of the time, the clients say they want innovation, but what they really want is risk reduction. They wouldn't hire a consultant if it wasn't about risk, they'd put together their own team and drive forward. Being broadly capable and well-studied, while I may not be quite as fast at building that graph database example as an expert in Neo4j or whatever, we're also not getting that person and have no idea when they are showing up. If they even exist in the company, they're busy on other projects in a completely different business unit (probably not even doing that, probably stuck in meetings). But I know I can get it done in a way that fits the schedule. Spending time reading the worst documentation known to mankind (Google's) because some drive-by said they did this once and used a Google product to do it is probably going to end in wasting you a lot of time only to realize that said drive-by didn't spend long enough actually listening to the meeting to understand the nuance of the problem. Time that you could have spent building your own and hitting your schedule with certainty. Sorry, it's late and I'm tired from a full quarter of 12 hour days trying to rescue a project that the previous team did nothing on for the previous quarter because... IDK why. No adults in the room.
fireattack 1y ago
What's NIH
- chrisweekly 1y ago
  Not Invented Here
- brian-armstrong 1y ago
  National Institute of Health
  - memming 1y ago
    This is what I thought too.
- rjh29 1y ago
  Short for Not Invented Here syndrome... when developers ignore existing libraries or solutions and implement their own version. Usually this is meant negatively, i.e. developers thinking they -need- to implement their own version, at great expense, when they could have just used an off-the-shelf library. However this article is positing that writing your own code is a good thing in some cases.
  - dickersnoodle 1y ago
    It is a good thing in some cases for a couple of reasons - first, off the shelf libraries often do a lot more things than are needed for the project at hand which can have the same effect that adding extra lanes to a highway does on traffic - more effort in the same space that could have been avoided. Second, OTS libraries can be opinionated, which winds up bending the existing codebase in ways that aren't optimal or aligned with the other code in a given ecosystem.
jeffhwang 1y ago
And here I thought I was going to read a novel defense of the British healthcare system.
- alex_young 1y ago
  NHS?
  - jeffhwang 1y ago
    Haha, I was doubly confused! You’re right, I should have said National Institutes of Health.
devjab 1y ago
Being in the energy sector dependencies is something we intentionally avoid because we'd actually have to go through and review changes. What has helped this immensely is AI code assistance. One of the primary uses is to use it to write CLI tools for code and config generation in the tool chain. All of it is around making your life easier, without pulling external dependencies. An example is that we create openapi docs with LLM's. Then we serve them with Go's net/http + FileServer, meaning that we never leave the standard library. Of course the LLM itself is a third party dependency, but when you use it to write CLI tools that then do the code generation, it never actually sees the code. That also means that the quality of those CLI tools are less important, because it is their output that matters. It only goes so long of course. I'm not sure any of our front-end engineers would want to live in a world where they weren't allowed to use React, but then, their products are treated as though they are external anyway. Anyway, it's a lot easier to make engineers stop using "quality of life" dependencies when you give them something that still makes their lives easy.
- landgenoot 1y ago
  Doesn't the LLM spit out the code of the dependency it has been trained on? How is that any different from just forking the dependency and treating it like your own?
  - smokel 1y ago
    One advantage might be that you would only implement the (small) part of the library that you actually need, potentially avoiding bugs such as Log4Shell. The risk of code duplication is a serious one though, and it would be nice if AI could automatically detect and clean this. I guess we are in an annoying "in-between" state of things, with a pretty unsure future.
    - nurettin 1y ago
      You would (probably) be avoiding commonly known exploits while introducing subtle AI-induced bugs like printing logs out of order or not locking/ordering resources properly.
xupybd 1y ago
The author is from New Zealand. You have to understand the Number 8 wire[1] mindset the has taken root there to put this in context. [1]https://en.wikipedia.org/wiki/Number_8_wire#:~:text=Accordingly%2C%20the%20term%20%22number%208,materials%20are%20available%20on%20hand. https://en.wikipedia.org/wiki/Number_8_wire#:~:text=Accordin...
- bitwize 1y ago
  TIL. I'm reminded of the Australian "She'll buff out, mate" meme.
- freetime2 1y ago
  I think just about every experienced developer I know - most of whom are not from NZ - would agree with this article. We've all been burned by using the wrong dependency for the job at some point, or the pain of having to deal breaking changes when upgrading a library that really wasn't necessary to use in the first place.
  - ironmagma 1y ago
    To push back on this article's thrust, those are actual issues that can occur with dependencies. It's just that they usually don't, and most dependencies are harmless, small, and transparent, so articles like this and people complaining about dependencies are almost always overstating their case. And therefore, adopting a "zero dependencies" policy is absolutely an overreaction.
    - freetime2 1y ago
      I don't think the author is actually arguing for zero dependencies here. While they do quote a "zero dependency policy" in one open source project as being "instructive", they also propose a "framework for evaluating dependencies" - which of course anyone advocating for zero dependencies would have no need for.
    - makeitdouble 1y ago
      I'd argue harmless, small and transparent dependencies are the easiest to avoid. The extreme of it "is_even", but any library that could fit in 200 lines should probably be owned code. Where the article hits is critical libraries that you heavily rely on and that your code is slowly formatted around. I'm thinking specific data parsers, fancy query brokers, time management libraries etc.
lmm 1y ago
People love to claim this, especially on this site, but in my experience it's the opposite. Many people like writing new code and will do it even when it's detrimental to the business, but 9 times out of 10 even using a "bad" dependency is far more effective than writing in-house.
- freetime2 1y ago
  Can I ask how seriously your company takes security vulnerabilities and licensing? I used to have a pretty lax attitude toward dependencies, but that changed significantly when I joined a company that takes those things very seriously.
  - lmm 1y ago
    I've worked with many companies over the years. License management should be automatic or mostly-automatic if you're taking dependency management seriously (particularly these days where so many projects use well-known open-source licenses and everything is machine-readable metadata), and I've never seen a single in-house codebase (even at e.g. F500 financial institutions) that took security more seriously than your average open-source library.
- friendzis 1y ago
  Dependencies are a double-edged sword. Most vocal people work on "disposable" end of software. It's cheaper for software giants to just throw engineer-hours at rewriting piece of code that has fallen into organizational obscurity than to maintain (hehe) maintainability. There is usually no sense for small branding/webshop factories to churn out high quality, maintainable code. However, I suggest you revisit the reason why the dreaded "enterprise patterns" exist in the first place. The main reason to use these architectures is so that five years down the line, when documentation is badly outdated, there is no organizational memory left behind that component, original developers have transitioned to either different teams/departments or left the company altogether, the component is still well isolated, analyzable and possible to work on. Introduction of external dependency(-ies) carry two inherent business risks: either support for dependency will be dropped, meaning you will have to either absorb maintenance burden yourself or switch dependencies, or it will introduce breaking changes, meaning you have to stick to unmaintained version or update your product code. Both situations will eventually impact your feature flow, whatever it is. Compromise between trunk and leaf (push of dependencies vs pull of deps) is intrinsic to modularization and is always there, however with internal components this compromise is internal, rather external. > Many people like writing new code and will do it even when it's detrimental to the business, but 9 times out of 10 even using a "bad" dependency is far more effective than writing in-house. If you are a SaaS company - most probably yes as it is the short-term outcome that is determinate of business success. However, if you work in any industry with safety and support requirements on software or put the burden of long term support on yourself, long-term horizon is more indicative of business success. Remember, writing new code is almost never the bottleneck in any mature-ish organization.
silisili 1y ago
> Sometimes it's easier to write it yourself than install the dependency This is definitely true, but only really relevant if you're either a solo dev or in for the long haul, so to speak. And it'll work way better for your use case too. The problem is working with others. Others coming in are more apt to try to learn a known or semi-known system than "Dave who used to work here's crazy thoughts." Especially in this market where longevity is rare, and company specific knowledge is useless as resume fodder. So from a dev standpoint it absolutely makes sense. From a business standpoint, probably markedly less so.
- toast0 1y ago
  Figuring out how to get others to install a dependency is even worse!
Tractor8626 1y ago
You can tell it is written by C programmer because they think installing dependencies is hard.
- mrheosuper 1y ago
  if it's not hard why do we have docker ?
  - Kwpolska 1y ago
    If dependency == library, it is hard in C or Python, but it isn’t in Rust or Java. You could easily run a Rust program on bare Linux, but using Docker might simplify the version management story. But even if you use a language with a sane dependency management story, you probably depend on PostgreSQL, and running it in Docker can be easier than installing it on the system (since distros really like to mess with the PostgreSQL configuration).
    - mrheosuper 1y ago
      Can Rust program link with Shared C library? If yes then I would argue they have the same problem with dependency version.
      - exDM69 1y ago
        Yes it can and yes indeed it's sometimes a pain in the ass. However, some (maybe even most) C libraries' Rust bindings deal with this automatically when installed via Cargo.
  - Cthulhu_ 1y ago
    Because while it's not hard, it's boring. Setting up an environment is boring and repetitive work, and Docker reduces that.
- JonChesterfield 1y ago
  C programmers don't install dependencies. That would be insane. Better to "vendor" them into the same tree as everything else and build them at the same time.
deleted 1y ago
[deleted]
travisgriggs 1y ago
I feel this post. I maintain software in Android, iOS, Python, embedded C, and of late adding Elixir to the mix. Some in the community will wine about lack of Elixir ecosystem. But often, I’m fine just putting together what I need. It varies. I don’t want to do my own bandit sever or Phoenix live view stuff. But MQTT, no probs. Often I find that the need for libraries can be an indictment of complexity against the problem space. Take Blootooth as an example. What a huge ball. Though at the end of the day, I’ve done straight to HCI python implementations that for some things are better than the “libraries” available. Don’t get me started on the “hold your hand” gpio libraries for the raspberry pi. One type of dependency, that I kind of miss is the “copy this code to your project” dependency. You can take complete ownership right away. Whereas with more crafted dependencies, the dependency surface is more than just an algorithm writ large in code, but a whole philosophy/metaphor that may not be an exact fit for your own project.
bob1029 1y ago
NIH is amazing as long as you are realistic about what you are taking ownership of. For example, the cost of maintaining a bespoke web frontend "framework" that is specific to your problem domain is probably justifiable in many cases. The same cannot be said for databases, game engines, web servers, cryptographic primitives, etc. If you have a problem so hard that no existing RDBMS or engine can support, you should seriously question the practicality of solving your problem at all. There's probably some theoretical constraint or view of the problem space you haven't discovered yet. Reorganizing the problem is a lot cheaper than reinventing the entire SQLite test suite from zero.
- abbotcabbot 1y ago
  > Reorganizing the problem is a lot cheaper than reinventing the entire SQLite test suite from zero. Sure, but if you aren't happy with existing DBs you are probably wrong in thinking you need a general DB instead of a file layout on a filesystem.
  - AstralStorm 1y ago
    It seems easy, but actually managing files as a database safely is actually very hard. Especially ensuring atomicity. Portability is a problem as well. You do not need an SQL database however, there are others available.
    - abbotcabbot 1y ago
      Of course these questions are hard and if you are asking them you may need a general db. The whole industry is wrapped up in these bizarre ideas that for the slightest requirement they are going to add just one more abstraction layer and it will do everything and the kitchen sink. But sometimes the requirement is simple and doesn't deserve solutions to anticipated problems and other times it does and is worth looking for an existing solution. Rarely the problem is complex and deserves a custom solution and then one should probably make a new startup for the one yak shave, etc..
  - bob1029 1y ago
vanschelven 1y ago
Dan Luu quoting Joel Spolsky: “Find the dependencies — and eliminate them.” When you're working on a really, really good team with great programmers, everybody else's code, frankly, is bug-infested garbage, and nobody else knows how to ship on time. [..] We didn't think that everyone else was producing garbage but, we also didn't assume that we couldn't produce something comparable to what we could buy for a tenth of the cost. from https://danluu.com/nothing-works/ https://danluu.com/nothing-works/
- brabel 1y ago
  After many years using libraries without any sort of vetting process, I completely agree in principle that most code out there is bug infested garbage. One dependency had a concurrency bug so severe it almost cost our company our biggest customer early in our journey. We forked and completely rewrote the library as after looking at the source it was clear they didn’t have nearly as much care with their code as we did. This was the worst case but we faced many bugs in widely used libraries. We can’t replace them all as time is short but if we could we would probably replace most of them.
fmajid 1y ago
Dependencies introduce risks, but not using them at all puts you at a competitive disadvantage against those who are using them and thus achieve faster development time and time to market. What you need is a process to manage dependencies: 1) Only consider open-source dependencies. 2) Introducing new dependencies requires a review. Not just a code review on the pull request introducing it, but checking the license, estimating how much work it would be to rip out, auditing it for history of security vulnerabilities or bugs, whether it is live and still gets updates, how vibrant the community is, and so on. 3) If possible, review your dependencies for possible security issues. Doing this at scale is expensive and the economics of this are still an unsolved problem (I have my ideas: https://blog.majid.info/supply-chain-vetting/ https://blog.majid.info/supply-chain-vetting/). 4) Do not adopt a dependency you are not willing and able to take over the maintenance of, or fork if necessary. At a minimum, it means you have built it from source at least once, not just used binary packages maintained by someone else. 5) Preemptively fork all your dependencies. People can and do delete their repos out of pique, see left-pad.
- dotancohen 1y ago
  This is amazingly insightful, thank you. I'm going to copy this to my own procedures files, on every dependency I use in the future. The only problem I really see is very tall dependency trees, seen in e.g. the JavaScript world.
- chii 1y ago
  Both 4) and 5) are very important, but often forgotten. Even for my own personal (small) projects, i've gotten hit with problems when i take an extended leave of absence and then return to a project, only to find my dependencies have become either completely outdated and unusable, or the repo was entirely deleted (with only a remote copy to build with). I've since adopted the "fork" method; the dependency's source is forked (privately), and get the dependency built; this is recursively done with their dependencies (stopping at the language level libraries), just to get familiar with their build chain. Only then, will i feel good enough to add the dependency to my project (and use their publicly released artefacts from their publicly hosted library repository). It's a bit of work, but i think this effort is spent upfront, and removes future effort if the project lives long enough to see the ecosystem move/change directions (and you dont want to follow). Sometimes i do find that source libraries (rather than pre-built binaries) to be better in this sense. I merely need to fork and link the sources into the project, rather than have to learn anything about build chains of dependencies...
eviks 1y ago
> Sometimes it's easier to write it yourself than install the dependency... A few examples wouldn't hurt... > Their breaking changes can trigger expensive re-writes of your own code to handle a new interface. Don't update them or NIH-update them just like you'd do with the original NIH code. Still a net win in saving the time for the initial coding > You need to ensure they end up on your clients' machine. Vendoring exists?
- moron4hire 1y ago
  The tolerance for the amount of time it takes to build a new thing is a lot looser than the tolerance for the amount of time it takes to fix an old thing in production with PMs screaming about down time.
  - eviks 1y ago
    Since none of the two alternatives guarantee no downtime bugs in production, you're missing some other factor that would make NIH preferable, like, maybe, testing (which the new thing would have but adding the old one wouldn't because ... tolerance)?
mrkeen 1y ago
Dozens of comments and no mention of DIP yet. You should absolutely use dependencies, and your should be able to tear them out as soon as you don't like them anymore. Including the dependency can even be part of your NIH if you're so inclined. Instantiate two copies of your code (dep/NIH) and test that they behave the same.
phplovesong 1y ago
Database drivers, crypto etc im always "installing", but for 97% of other stuff i tend to roll my own. And when i dont want to reinvent the wheel, i take time to vet the depency. How many LOC? Does it has deps of its own? Is it a maintained library? Can i fork/fix bugs?
deleted 1y ago
[deleted]
midasz 1y ago
Either way you wrap each thing that acts as a dependency, even if it's internal. I treat dependencies another team in my company delivers the same as any other third party dependency. Never use the classes but always just wrap around them in a service or component. When my 'task' is to publish things on a Kafka bus I create a publishing service that takes in an object that I control, only inside that service is there actual talk about the dependency and preferably even that's a bit wrapped. It's easy to go too far with this but a little bit of wrapping keeps you safe.
000ooo000 1y ago
Everybody loves NIH until what gets invented is dogshit. Seriously, it's easy to romanticise the idea but wait until you have to work on something that evolved over a decade without any refactoring or documentation, and worse, the author is a lifer who couldn't ever imagine that their code could use improvement. I'll migrate to whatever silly API react router has cooked up this year over living that again, thanks.
VonTum 1y ago
They could've at least added left-pad as an example of a bad dependency, instead of the cop-out
solatic 1y ago
Author points to TigerBeetle as an example, which I wasn't familiar with, so I went down a rabbit hole. Wow. Yeah. If you're writing a financial ledger transactions database from scratch in Zig, where safety and performance are your top two goals, so that you can credibly handle a million transactions per second on a single CPU core, well, damn right you can't afford to take any risks on introducing any dependencies. Makes absolute perfect sense to me (no sarcasm). But the average developer, writing most line-of-business CRUD systems, well, quite honestly they're not that strong to begin with. Most dependencies may be bug-infested garbage, but they're still higher quality compared to what most developers are capable of. Most companies are bottlenecked by the caliber of talent they can realistically recruit and retain; and internal development standards reflect the average caliber on the payroll. So like most advice you read on the internet, remember, everybody is in different circumstances; and polar opposite pieces of advice can both be correct in different circumstances.
- vasco 1y ago
  It doesn't even have to be related to quality of developers. Whatever tool chain or product you use, you're using someone else's dependencies. In some places more than others, but most people aren't implementing their own matrix multiplication code, and the ones that are, aren't implementing random library #24 which isn't in their core business. So this whole discussion happens on black and white terms when in fact people only care if they have regulatory obligations, or they have a particular personal interest in implementing something, or they got attached to that idea for a specific library. But nobody is applying this fully or they'd still be at the beach collecting sand.
  - jorangreef 1y ago
    We apply this pretty much fully at TigerBeetle [1]. Reason being that TigerStyle is not only about shipping safer software, but shipping it in less time [2], factoring in the Total Cost of Ownership to end users. In other words, not only optimizing our development time, but also all the time spent in production with subsequent fixes. [1] https://tigerbeetle.com/blog/2025-02-27-why-we-designed-tigerbeetles-docs-from-scratch/ https://tigerbeetle.com/blog/2025-02-27-why-we-designed-tige... [2] https://www.youtube.com/watch?v=w3WYdYyjek4 https://www.youtube.com/watch?v=w3WYdYyjek4
iamsaitam 1y ago
One huge overlooked advantage of using dependencies is knowledge transfer. Software projects (for the moment) require people to write them and people move between jobs. There is a lot of common requirements between different software applications, it would be terrible if everyone just relied on what the standard lib offers. PS: I assume this would be akin to soviet communism, where the state gives you "everything" and the rest you fashion at home. (being extremely loose here, do forgive me)
VonTum 1y ago
For me the "should I use a library for this" comes down to if I want to be able to dip under the abstraction. For instance: terminal color codes. I'm building for linux, but would like my code to be reasonably portable to other platforms. By inserting my own \033[m... Codes, I take responsibility for doing colors on other platforms too, whereas a dependency absolves me of that. On the other hand, if I need a graph algorithm like Bellman-Ford, I don't want to reach for a library, because that immediately forces me to use their structs for every graph node. I might also want to tune BF specifically to my graph's shapes, etc.
- wink 1y ago
  Interestingly I've only ever ran into this problem (as being a problem) in Advent of Code - you need a certain (more exotic) graph algorithm and you only find an example that goes contrarian to your current model. At work I don't seem to need these weird algorithms, or they are in the language's standard library/default math or graph package and it's not worth reimplementing anyway.
- account42 1y ago
  > whereas a dependency absolves me of that Except it doesn't. Users don't care if the reason something is broken on their platform is your own code or a dependency. IME platform abstractions often tend to be a trap because they can only abstract 90% without making compromised whereas if you do it yourself you can pierce the abstraction for the remaining 10% and get the best result on all platforms.
zelphirkalt 1y ago
Recently I had a good time avoiding a few dependencies. I am developing a project using Django and it go to a size, where I felt I should add testing to it. But to test things, I would need instances of model classes. However, I didn't want to have to specify all the required fields every time I needed an instance for a test. The fields might be mandatory, but not always relevant for each test. Such a field needs to be filled, but not necessarily by me in the test code. I knew from earlier projects, that Faker generates random data and in the past I have thought it shouldn't be difficult to write a thing that generates random strings and numbers and ids for fields, and recursively other required entities. So I decided to write it myself [1], rather than introducing factory boy and faker as dependencies. Sure those libraries will have a lot more features, but my code is simple and does what I need and I gained additional understanding of the complications with Django's model handling. I also suspect, that factory boy has to hack around some issues, that I avoided by always creating entities in the database, which most of my code is doing anyway. I am not sure how they solved creating instances of models, that have many to many fields without persisting the entities in the database for example, because Django raises an error when one tries to do set a value for such a many to many field, without storing the entity in the database first, so that it gets an id. Which makes sense. So I suspect there is quite some magic in that dependency, that I don't need for now. What's more is, that my factory functions are just as easy to use, if not easier. I simply do `factory_for_model(MyModel)(kwargs)`. It is also easy to add more functionality like `gen_multiple(factory, count)` for example. Uniqueness is more difficult, due to how Django's fields and models are compared. But as far as I understand neither does Faker do uniqueness out of the box. I may be wrong about that though. I also developed a decorator for pytest functions, that helps me avoiding long test names and instead puts a test description in the decorator arguments. Those sentence long test names have previously annoyed me and always caused linting to attack me for it. [1]: https://codeberg.org/ZelphirKaltstahl/web-app-vocabulary-trainer/src/commit/500233e9d40413307889a98058a0e9906d883ecd/site/voctrain/tests/factories.py https://codeberg.org/ZelphirKaltstahl/web-app-vocabulary-tra...
- m000 1y ago
  Test-only dependencies should be maintained separately from functional dependencies. For standardized things like testing, I'm not sure if DIY makes sense. Even if you use 10% of its capabilities, sticking with an established test framework makes your codebase more maintainable and easier for others to contribute to.
nc0 1y ago
NIH is cool and all for greenfield projects but please remember that most of industrial work today is compatibility with old standards and behaviors, dealing with their bugs and edge cases. In that case, a third-party dependency that has been existing for 20 years will be better.
- eapriv 1y ago
  If you have a third-party dependency that survived for 20 years. But what if you are trying to choose what to rely on today, and to decide if it will even exist in 20 years? Certainly none of the fashionable JavaScript frameworks will.
panstromek 1y ago
I find both the article and the title a bit too simplistic for the topic. This is the classic "build vs buy" problem and I think it's one of the hardest problems in softare development and maybe engineering in general. I've been bitten by both sides of the decision many times and apart from trivial cases (like `is-even`), it's hard to come up with universal rule of thumb to decide this, especially for cases where it matters.
danesparza 1y ago
I mistakenly read the article thinking it was about the National Institute of Health. :-(
0x000xca0xfe 1y ago
NIH can also be great if you only need a subset of a "mature" dependency but you need to really nail it. Since it is a solved problem you'll likely find ample documentation, algorithms and code examples so there is much less that can go wrong than in a greenfield project. At my last job we rewrote InfluxDB as it as was too resource-hungry for our embedded device and the result was fantastic. 10x the time series storage at a fraction of the memory and CPU utilization, much more robust and flash-friendly.
cmsj 1y ago
I'm honestly increasingly skeptical of any third party dependencies as I age through my career. Before I'll agree to depend on a build tool, package or library, I either need to be convinced that: 1) It has a good chance of a decently maintained future 2) The blast radius of replacing it would be acceptable
Cthulhu_ 1y ago
There's also the distinction between a library - a tool that does one particular thing and does it well - and a framework - which dictates how you structure your entire application. And this is a mindset as well. I mainly know the original quote in the context of Go, where the community as a whole (or at least the part that is in the Slack server) eschews big frameworks in favor of the standard library, lightweight architectures, and specialized libraries. A lot of people coming from other languages come into the communities and ask about whether there's anything like Spring for Go. Another common request is help with a major framework or abstraction like Gin (web API framework) or GORM (database ORM). But Gin is no longer really necessary as the SDK has good support for the common web API use cases, and GORM quickly breaks down as soon as you need anything more advanced than querying a single table, not to mention it's big and complicated but has only one lead developer (I believe), no major organization behind it. But Gin and GORM dictate how you structure at least part of your application; especially the latter adds a layer of indirection so you no longer have to ask "how to I join two tables in SQL" but "how do I join two tables in GORM", the latter of which becomes very specialized very fast. Anyway. Using the standard library is preferable, using small and focused libraries for specific problems that aren't solved by the standard library is also fine. Copy / pasting only the functions you need is also fine.
nyeah 1y ago
Awesome! A literal actual debate between absurd humongous dependencies and the known dumbness of "Not Invented Here". Pick a wrong side folks. (No, "respect for reality" doesn't count as a side. Try again.)
tacker2000 1y ago
So after 2 mins i figured out what NIH means. Would be nice to at least explain it once at the beginning thought. There are many articles that use acronyms and not everyone knows WTH is going on.
- a3w 1y ago
  "New, in-house" development? Would be my guess. Still left guessing.
  - anthomtb 1y ago
    "Not Invented Here". My American brain, of course, immediately went to "National Institute of Health" and thought this was a software developer opining on the current administrations distaste for federal funding of anything.
  - a_e_k 1y ago
    https://en.wikipedia.org/wiki/Not_invented_here https://en.wikipedia.org/wiki/Not_invented_here
  - deleted 1y ago
    [deleted]
the_real_cher 1y ago
What is NIH? I couldn't find it in the article
- ijlx 1y ago
  "Not invented here." Refers to the tendency to avoid using things from outside one's company/organization.
nijave 1y ago
>Often they're so large and complex that simply writing the functionality yourself is faster than learning. Sometimes it's easier to write it yourself than install the dependency... Sometimes for good reason. Re-implementing something like HTTP with TLS is non-trivial and surely not easier to rewrite yourself... On the other hand, left-pad.
PaulHoule 1y ago
I can't say I am that impressed with ECMA-48. Back when it was VT-100s connected to a VAX or logging into a BBS over a 9600 baud modem with a PC I felt satisfied. Even when there was a bit of line noise. Ever since 1990 or so when it has been using "telnet" or the equivalent on an xterm or CMD.EXE or some other GUI application that emulates I've never trusted it to work 100% right. Maybe 99.5%, but I expect the cursor to be a column off where it is supposed to be, for there to just be a little misalignment here and there. I mean, other people don't complain, but people don't complain when the center channel is burned out at the cinema or when the Linux desktop has a 179px wide label in a 59px wide space and such. It's one reason I gave up on emacs and just use the 20% of vi functionality I know (hit 'i' and pretend that it's Notepad, as least ESC + :wq doesn't confound my muscle memory for ^S being search the way ^S and ^X^S do) when I am logged into a busted Linux install to get the package manager running again but really use IntelliJ IDEA as much as I can.
mtlynch 1y ago
>Instructive here is Tigerbeetle, a financial database written entirely with Vanilla Zig: How does TigerBeetle's existence support the argument that rolling your own dependencies is better than using off-the-shelf tools? TigerBeetle has existed as a company for less than three years, they haven't reached a 1.0 release, and they have a single-digit number of engineers. As far as I can tell, they haven't even reached the point of self-sufficiency, as they raised another round of VC funding a year ago. The pain of rolling your own tools happens as you grow and your needs change. Rolling your own static site generator[0] is fine when you only have a handful of engineers, but I suspect over time, they'll burn more time on their homegrown HTML templating solution[1] than if they had just used a battle-tested, off-the-shelf solution like Hugo. The only dependency TigerBeetle accepted is Zig, which also hasn't reached a stable 1.0 release and frequently forces developers to rewrite their code to deal with breaking changes, including a major one coming in Zig 0.15.0.[2] I like TigerBeetle, but they're not proof of anything yet. For every TigerBeetle, there are a hundred profitable companies whose entire business depends on WordPress with 50 plugins they picked at random. Aside from TigerBeetle, I find most of the arguments in this article weak. They sound like rationalization for a developer who enjoys rolling their own tools and seem not to consider actual business value. The article also leaves out what I think is the most important consideration in evaluating dependencies: lock-in. How difficult is it to swap out this dependency later? Because if the answer is, "very easy" most of the other considerations don't matter. There's no use doing an exhaustive survey of image processing libraries when you can swap out your choice with a few hours of dev work. But choosing something like a storage backend is very difficult to change later, so you want to put more thought into it. [0] https://tigerbeetle.com/blog/2025-02-27-why-we-designed-tigerbeetles-docs-from-scratch/ https://tigerbeetle.com/blog/2025-02-27-why-we-designed-tige... [1] https://github.com/tigerbeetle/tigerbeetle/blob/86b85ab60395dedec8b1c47df062cb2b840c9413/src/docs_website/src/html.zig#L21-L72 https://github.com/tigerbeetle/tigerbeetle/blob/86b85ab60395... [2] https://github.com/ziglang/zig/pull/24329 https://github.com/ziglang/zig/pull/24329
- jorangreef 1y ago
  > How does TigerBeetle's existence support the argument that rolling your own dependencies is better than using off-the-shelf tools? At least from my own experience, without TigerStyle [0], there's no way we could have shipped TigerBeetle from 0 to production in 3.5 years, with the same quality, and to the same tolerances: https://jepsen.io/analyses/tigerbeetle-0.16.11 https://jepsen.io/analyses/tigerbeetle-0.16.11 Whereas, for example, if we'd used off-the-shelf dependencies such as Raft or RocksDB, it would have been a nightmare, and taken longer, just to fix them up to solve our storage fault model and implement Protocol-Aware Recovery correctly. Even then, we'd have been stuck with a systems language of the last 30 years (C/C++), when we could have invested in a language for the next 30 and with a more powerful toolchain. Of course, we'd also have been without Deterministic Simulation Testing, because most software dependencies are typically not designed for DST. But finally (and to your point about sustainability), without TigerStyle, we wouldn't have had the company, or the investment, team, and customers we have today, or be as far along financially. Not saying that you need to share our engineering philosophy. But it works for us. [0] https://www.youtube.com/watch?v=w3WYdYyjek4 https://www.youtube.com/watch?v=w3WYdYyjek4
ChrisMarshallNY 1y ago
Well, as a battle-scarred old war horse, I can say that "It Depends™." I have found that "It Depends™" is a mantra for almost everything that I do, and experience has given me the ability to choose a fork in the road, when an "It Depends™" moment happens. When I was younger, my world was governed by "hard and fast" rules. There could be no exceptions, and some of the worst code I wrote, consisted of the gymnastics required to shoehorn an unsuitable library/paradigm into my projects. I tend to use a lot of self-developed dependencies. They are really distillations of things that I do frequently, so I factor them into standalone packages. That way, I don't have to reinvent the wheel, and I'm confident of the Quality and provenance. But if there's functionality that is required, and beyond me, for whatever reason, I am always open to including dependencies, as long as I can reconcile myself to their quality and other issues.
compiler-guy 1y ago
This echoes the Joel On Software Classic, "In Defense of Not-Invented-Here-Syndrome", which gives some of the reasons Microsoft Excel won the spreadsheet wars. Of particular note: =-=-= “The Excel development team will never accept it,” he said. “You know their motto? ‘Find the dependencies — and eliminate them.’ They’ll never go for something with so many dependencies.” https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-invented-here-syndrome/ https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-...
anthomtb 1y ago
> One of the biggest fallacies in coding is that dependencies have zero downsides. Am I the only one who hates when articles start with a strawman like this? Or does the author of TFA really know people who think dependencies have zero downsides? Just the word "dependency" brings to mind infantile helplessness. I cannot believe anyone is out there opining a lack of downsides.
iainctduncan 1y ago
I do technical diligence on companies getting purchased or invested in, largely by private equity. Previous to that I was a developer for 15 years (still am, but open source now). One big one not touched on in the article is the cost of security updates. I see this all the time... companies that are in a bad position because they have too many dependencies and have wound up unable (for business reasons) to dedicate adequate resources to keeping them all current, and then end up with past EOL deps with published vulnerabilities. This – literally – costs them a lot at acquisition time. The purchaser (who is typically very risk averse) factors in all the cost to get things up to date and takes it off the price. This can be very significant. (looking at you, React et. al!) On the other hand, I've seen companies where they used as little in deps as they could get away with, and they wind up in very strong positions. There really is a big labour cost in chasing the latest versions of underlying frameworks when those move too fast.
vincent-manis 1y ago
I take neither side in a dependencies vs NIH war. I like using SQLite as a database, and I use Tk (of Tcl/Tk) as my user interface toolkit, for example. Neither of those is going anywhere, they are both maintained, and I build them myself. I would argue that the right way to think about dependencies, as some have alluded to, is to do a risk/benefit analysis. On the benefit side, how much work would it take me to duplicate this component, how well will it suit my needs, and so on. On the risk side, everything from continued maintenance to security and licence issues (for both free/libre/open-source and proprietary components). Then risk/benefit asks for ways of ameliorating risk, such as by forking code, or paying for support. The right way to think of adding a dependency is to ask and answer questions like this prior to adding it. This is not the way that JavaScript developers used left_pad, they just said “it's in npm, so it's good.”

310 points by todsacerdoti 1y ago

KingOfCoders 1y ago

With AI NIH will be the new normal.

WalterGR 1y ago
Why not ask AI how to use <appropriate library / framework> to implement <thing>? Doesn’t seem like you can blame NIH on AI more than other motivations for NIH. Edit to add: If AI makes NIH easier, then it implies that AI is good at solving problems, and speaks to AI’s credit.
- KingOfCoders 1y ago
  From me using Claude Code, without a proper system prompt, Claude generates code rather than using a library, this week e.g. command line parameter and flag parsing. The difficulty is where the tipping point is to use a library, it can't be https://www.npmjs.com/package/is-even https://www.npmjs.com/package/is-even
BigJono 1y ago
I wish. As far as I can tell the Venn diagram of people building piles of shit with NPM and people building piles of shit with LLMs seems pretty close to a circle.

barisozmen 1y ago

Completely agree. It's one of the most important skills to know which dependency is good and which is bad. My two cents. If a dependency is paid, than it is usually bad. Because the company providing that dependency has an incentive to lock you in. As another point, "dependency minimalism" is a nice name for it. https://x.com/VitalikButerin/status/1880324753170256005 https://x.com/VitalikButerin/status/1880324753170256005

ehnto 1y ago
As well, paid dependencies usually only have one source of support, and when the company goes under or stops supporting the product you are in rough seas. Given very few companies last forever, you have to assess if the trajectory of your project would be impacted by being coupled to their ability to support you.
- barisozmen 1y ago
  Exactly. That's another point
- swiftcoder 1y ago
  > when the company goes under or stops supporting the product Or, even worse, gets acquired by someone like Salesforce
- Cthulhu_ 1y ago
  For sure, this goes into the terrain of acquisition though, for which there are long-running procedures and assessment criteria. Long-term support / company longevity is one of them. But likewise, these companies have the incentive to look like they have long-running success and can be relied upon for years / decades to come.
AdieuToLogic 1y ago
> My two cents. If a dependency is paid, than it is usually bad. Because the company providing that dependency has an incentive to lock you in. Vendor lock-in is a risk for both purchased components and FOSS ones where the organization is unwilling to assume maintenance. The onus is on the team incorporating third-party component(s) to manage their risk, identify alternatives as appropriate, and modularize their solutions.
7402 1y ago
If a dependency is paid and it is bad, then maybe you just aren't paying enough for it. If my code has a dependency then I want there to be people whose feel it is their job to support it. Either there have to be enough people who are paid to support it, or there have to be enough people whose self-worth and identity is so wrapped up in the code that they take it as a point of honor to support it. I don't need a company that's likely to abandon a code product and leave me hanging. I also don't need a free software author who says "bugs are not my problem - you have the source, go fix it yourself." If those are my choices, I'd rather write it myself.

barisozmen 1y ago

"One technique for making software more robust is to minimize what your software depends on – the less that can go wrong, the less that will go wrong. Minimizing dependencies is more nuanced than just not depending on System X or System Y, but also includes minimizing dependencies on features of systems you are using." From http://nathanmarz.com/blog/principles-of-software-engineering-part-1.html http://nathanmarz.com/blog/principles-of-software-engineerin...

skydhash 1y ago

A good question I ask myself is: Can I vendor it in? If I cannot, that’s usually something standard, but also a complex domain (crypto, network protocol, platform framework,…). Anything else, I assume it’s only a short term gain, so I make sure to explore the library and get a good understanding of its internals.

betaby 1y ago
Vendoring is somewhat an answer, but not always. I have some python code, vitrualenv is an obvious solution. However, older modules depend on older python3.9 behavior. And python 3.9 EOL is October 2025.
- skydhash 1y ago
  Vendoring is taking the responsibility to maintain it as part of your codebase instead of relying on third party, not just capturing a snapshot.
- eviks 1y ago
  What's the difference vs a state where you wrote the code many years ago that defends on 3.9?
3eb7988a1663 1y ago
I am failing to find it, but Simon Willison had a post where he vendored some small (<1000 line) blob of code instead of adding it as a dependency. The trick was that he had some Github action(?) automation which would automatically check if the vendored version ever fell out of sync with upstream. Get the benefits of vendoring while minimizing your actual support burden. Only a realistic strategy for small bits of code, but I have considered do the same for a few utility libraries which are a focused niche, but subtle enough that you would rather outsource the complexity.

kazinator 1y ago

Note that the ECMA-48 escape sequences themselves are the good dependency, not abstractions that hide them, like your tput command or curses or what have you.

bubblyworld 1y ago
I think the OP's article is saying that they are both good and bad depending on the context. You need to evaluate these things on a case by case basis. Writing a little TUI for yourself or your team? Sure, go nuts with escape codes. Making a well supported tool that runs on any developer's machine? Maybe consider curses, there are probably more edge cases than you think. Trying to find product market fit as a startup? Who gives a duck, find some customers before you care too much about the tech =P cattle not pets etc

zdw 1y ago

The ubiquity criteria also informs scaling - for example, if a tooling or backend dependency is being production deployed by a company at a scale of 10^2 or 10^3 times your use case, you're much less likely to hit insurmountable performance issues until you get to similar scale. They're also much more likely to find/fix bugs affecting that scale earlier than you do, and many companies are motivated to upstream those fixes.

moron4hire 1y ago
I don't agree. Some of the worst bugs I've hit have been in libraries written by very large companies, supposedly "the best and brightest" (Meta, Google, Microsoft, in that order) but it takes forever for them to respond to issues. Some issues go on for years. I've spent months working in issue trackers discussing PRs and whether or not we can convince some rules-lawyer it doesn't warrant a spec change (HINT: you never convince him), chasing that "it's faster/cheaper/easier to use a 3rd party package" dragon, only to eventually give up, write my own solution, fix the core issue, and do it in less time than I've already wasted. And probably improve overall performance while I'm at it. I think a lot of it depends on the exact field you're working in. If you're working in anything sniffing close to consulting, work is a constant deluge of cockamamie requests from clients who don't understand they aren't paying you enough to throw together a PhD research thesis in a month with a revolving crew of junior developers you can't grow and keep because the consulting firm won't hire enough people with any amount of experience to give the small handful of senior developers they keep dragging into every God damned meeting in the building so we can have a chance to come up for air every once in a while. I'm at a point where I have enough confidence in my skills as a software developer that I know pretty much for certain whether I can develop a given solution. There are very few I can't. I'm not going to try to train an AI model on my own. I won't try to make my own browser. A relational database with all the ACID trimmings, no. But I'll definitely bang out my own agentic system running off of local inference engines. I'll for sure implement an offline HTML rendering engine for the specific reports I'm trying export to an image. I'll build a fugging graph database from scratch because apparently nobody can make one that I can convince anyone to pay for (budget: $0) that doesn't shit the bed once a week. Most of the time, the clients say they want innovation, but what they really want is risk reduction. They wouldn't hire a consultant if it wasn't about risk, they'd put together their own team and drive forward. Being broadly capable and well-studied, while I may not be quite as fast at building that graph database example as an expert in Neo4j or whatever, we're also not getting that person and have no idea when they are showing up. If they even exist in the company, they're busy on other projects in a completely different business unit (probably not even doing that, probably stuck in meetings). But I know I can get it done in a way that fits the schedule. Spending time reading the worst documentation known to mankind (Google's) because some drive-by said they did this once and used a Google product to do it is probably going to end in wasting you a lot of time only to realize that said drive-by didn't spend long enough actually listening to the meeting to understand the nuance of the problem. Time that you could have spent building your own and hitting your schedule with certainty. Sorry, it's late and I'm tired from a full quarter of 12 hour days trying to rescue a project that the previous team did nothing on for the previous quarter because... IDK why. No adults in the room.

fireattack 1y ago

What's NIH

chrisweekly 1y ago
Not Invented Here
brian-armstrong 1y ago
National Institute of Health
- memming 1y ago
  This is what I thought too.
rjh29 1y ago
Short for Not Invented Here syndrome... when developers ignore existing libraries or solutions and implement their own version. Usually this is meant negatively, i.e. developers thinking they -need- to implement their own version, at great expense, when they could have just used an off-the-shelf library. However this article is positing that writing your own code is a good thing in some cases.
- dickersnoodle 1y ago
  It is a good thing in some cases for a couple of reasons - first, off the shelf libraries often do a lot more things than are needed for the project at hand which can have the same effect that adding extra lanes to a highway does on traffic - more effort in the same space that could have been avoided. Second, OTS libraries can be opinionated, which winds up bending the existing codebase in ways that aren't optimal or aligned with the other code in a given ecosystem.

jeffhwang 1y ago

And here I thought I was going to read a novel defense of the British healthcare system.

alex_young 1y ago
NHS?
- jeffhwang 1y ago
  Haha, I was doubly confused! You’re right, I should have said National Institutes of Health.

devjab 1y ago

Being in the energy sector dependencies is something we intentionally avoid because we'd actually have to go through and review changes. What has helped this immensely is AI code assistance. One of the primary uses is to use it to write CLI tools for code and config generation in the tool chain. All of it is around making your life easier, without pulling external dependencies. An example is that we create openapi docs with LLM's. Then we serve them with Go's net/http + FileServer, meaning that we never leave the standard library. Of course the LLM itself is a third party dependency, but when you use it to write CLI tools that then do the code generation, it never actually sees the code. That also means that the quality of those CLI tools are less important, because it is their output that matters. It only goes so long of course. I'm not sure any of our front-end engineers would want to live in a world where they weren't allowed to use React, but then, their products are treated as though they are external anyway. Anyway, it's a lot easier to make engineers stop using "quality of life" dependencies when you give them something that still makes their lives easy.

landgenoot 1y ago
Doesn't the LLM spit out the code of the dependency it has been trained on? How is that any different from just forking the dependency and treating it like your own?
- smokel 1y ago
  One advantage might be that you would only implement the (small) part of the library that you actually need, potentially avoiding bugs such as Log4Shell. The risk of code duplication is a serious one though, and it would be nice if AI could automatically detect and clean this. I guess we are in an annoying "in-between" state of things, with a pretty unsure future.
  - nurettin 1y ago
    You would (probably) be avoiding commonly known exploits while introducing subtle AI-induced bugs like printing logs out of order or not locking/ordering resources properly.

xupybd 1y ago

The author is from New Zealand. You have to understand the Number 8 wire[1] mindset the has taken root there to put this in context. [1]https://en.wikipedia.org/wiki/Number_8_wire#:~:text=Accordingly%2C%20the%20term%20%22number%208,materials%20are%20available%20on%20hand. https://en.wikipedia.org/wiki/Number_8_wire#:~:text=Accordin...

bitwize 1y ago
TIL. I'm reminded of the Australian "She'll buff out, mate" meme.
freetime2 1y ago
I think just about every experienced developer I know - most of whom are not from NZ - would agree with this article. We've all been burned by using the wrong dependency for the job at some point, or the pain of having to deal breaking changes when upgrading a library that really wasn't necessary to use in the first place.
- ironmagma 1y ago
  To push back on this article's thrust, those are actual issues that can occur with dependencies. It's just that they usually don't, and most dependencies are harmless, small, and transparent, so articles like this and people complaining about dependencies are almost always overstating their case. And therefore, adopting a "zero dependencies" policy is absolutely an overreaction.
  - freetime2 1y ago
    I don't think the author is actually arguing for zero dependencies here. While they do quote a "zero dependency policy" in one open source project as being "instructive", they also propose a "framework for evaluating dependencies" - which of course anyone advocating for zero dependencies would have no need for.
  - makeitdouble 1y ago
    I'd argue harmless, small and transparent dependencies are the easiest to avoid. The extreme of it "is_even", but any library that could fit in 200 lines should probably be owned code. Where the article hits is critical libraries that you heavily rely on and that your code is slowly formatted around. I'm thinking specific data parsers, fancy query brokers, time management libraries etc.

lmm 1y ago

People love to claim this, especially on this site, but in my experience it's the opposite. Many people like writing new code and will do it even when it's detrimental to the business, but 9 times out of 10 even using a "bad" dependency is far more effective than writing in-house.

freetime2 1y ago
Can I ask how seriously your company takes security vulnerabilities and licensing? I used to have a pretty lax attitude toward dependencies, but that changed significantly when I joined a company that takes those things very seriously.
- lmm 1y ago
  I've worked with many companies over the years. License management should be automatic or mostly-automatic if you're taking dependency management seriously (particularly these days where so many projects use well-known open-source licenses and everything is machine-readable metadata), and I've never seen a single in-house codebase (even at e.g. F500 financial institutions) that took security more seriously than your average open-source library.
friendzis 1y ago
Dependencies are a double-edged sword. Most vocal people work on "disposable" end of software. It's cheaper for software giants to just throw engineer-hours at rewriting piece of code that has fallen into organizational obscurity than to maintain (hehe) maintainability. There is usually no sense for small branding/webshop factories to churn out high quality, maintainable code. However, I suggest you revisit the reason why the dreaded "enterprise patterns" exist in the first place. The main reason to use these architectures is so that five years down the line, when documentation is badly outdated, there is no organizational memory left behind that component, original developers have transitioned to either different teams/departments or left the company altogether, the component is still well isolated, analyzable and possible to work on. Introduction of external dependency(-ies) carry two inherent business risks: either support for dependency will be dropped, meaning you will have to either absorb maintenance burden yourself or switch dependencies, or it will introduce breaking changes, meaning you have to stick to unmaintained version or update your product code. Both situations will eventually impact your feature flow, whatever it is. Compromise between trunk and leaf (push of dependencies vs pull of deps) is intrinsic to modularization and is always there, however with internal components this compromise is internal, rather external. > Many people like writing new code and will do it even when it's detrimental to the business, but 9 times out of 10 even using a "bad" dependency is far more effective than writing in-house. If you are a SaaS company - most probably yes as it is the short-term outcome that is determinate of business success. However, if you work in any industry with safety and support requirements on software or put the burden of long term support on yourself, long-term horizon is more indicative of business success. Remember, writing new code is almost never the bottleneck in any mature-ish organization.

silisili 1y ago

> Sometimes it's easier to write it yourself than install the dependency This is definitely true, but only really relevant if you're either a solo dev or in for the long haul, so to speak. And it'll work way better for your use case too. The problem is working with others. Others coming in are more apt to try to learn a known or semi-known system than "Dave who used to work here's crazy thoughts." Especially in this market where longevity is rare, and company specific knowledge is useless as resume fodder. So from a dev standpoint it absolutely makes sense. From a business standpoint, probably markedly less so.

toast0 1y ago
Figuring out how to get others to install a dependency is even worse!

Tractor8626 1y ago

You can tell it is written by C programmer because they think installing dependencies is hard.

mrheosuper 1y ago
if it's not hard why do we have docker ?
- Kwpolska 1y ago
  If dependency == library, it is hard in C or Python, but it isn’t in Rust or Java. You could easily run a Rust program on bare Linux, but using Docker might simplify the version management story. But even if you use a language with a sane dependency management story, you probably depend on PostgreSQL, and running it in Docker can be easier than installing it on the system (since distros really like to mess with the PostgreSQL configuration).
  - mrheosuper 1y ago
    Can Rust program link with Shared C library? If yes then I would argue they have the same problem with dependency version.
    - exDM69 1y ago
      Yes it can and yes indeed it's sometimes a pain in the ass. However, some (maybe even most) C libraries' Rust bindings deal with this automatically when installed via Cargo.
- Cthulhu_ 1y ago
  Because while it's not hard, it's boring. Setting up an environment is boring and repetitive work, and Docker reduces that.
JonChesterfield 1y ago
C programmers don't install dependencies. That would be insane. Better to "vendor" them into the same tree as everything else and build them at the same time.

deleted 1y ago

[deleted]

travisgriggs 1y ago

I feel this post. I maintain software in Android, iOS, Python, embedded C, and of late adding Elixir to the mix. Some in the community will wine about lack of Elixir ecosystem. But often, I’m fine just putting together what I need. It varies. I don’t want to do my own bandit sever or Phoenix live view stuff. But MQTT, no probs. Often I find that the need for libraries can be an indictment of complexity against the problem space. Take Blootooth as an example. What a huge ball. Though at the end of the day, I’ve done straight to HCI python implementations that for some things are better than the “libraries” available. Don’t get me started on the “hold your hand” gpio libraries for the raspberry pi. One type of dependency, that I kind of miss is the “copy this code to your project” dependency. You can take complete ownership right away. Whereas with more crafted dependencies, the dependency surface is more than just an algorithm writ large in code, but a whole philosophy/metaphor that may not be an exact fit for your own project.

bob1029 1y ago

NIH is amazing as long as you are realistic about what you are taking ownership of. For example, the cost of maintaining a bespoke web frontend "framework" that is specific to your problem domain is probably justifiable in many cases. The same cannot be said for databases, game engines, web servers, cryptographic primitives, etc. If you have a problem so hard that no existing RDBMS or engine can support, you should seriously question the practicality of solving your problem at all. There's probably some theoretical constraint or view of the problem space you haven't discovered yet. Reorganizing the problem is a lot cheaper than reinventing the entire SQLite test suite from zero.

abbotcabbot 1y ago
> Reorganizing the problem is a lot cheaper than reinventing the entire SQLite test suite from zero. Sure, but if you aren't happy with existing DBs you are probably wrong in thinking you need a general DB instead of a file layout on a filesystem.
- AstralStorm 1y ago
  It seems easy, but actually managing files as a database safely is actually very hard. Especially ensuring atomicity. Portability is a problem as well. You do not need an SQL database however, there are others available.
  - abbotcabbot 1y ago
    Of course these questions are hard and if you are asking them you may need a general db. The whole industry is wrapped up in these bizarre ideas that for the slightest requirement they are going to add just one more abstraction layer and it will do everything and the kitchen sink. But sometimes the requirement is simple and doesn't deserve solutions to anticipated problems and other times it does and is worth looking for an existing solution. Rarely the problem is complex and deserves a custom solution and then one should probably make a new startup for the one yak shave, etc..
- bob1029 1y ago

vanschelven 1y ago

Dan Luu quoting Joel Spolsky: “Find the dependencies — and eliminate them.” When you're working on a really, really good team with great programmers, everybody else's code, frankly, is bug-infested garbage, and nobody else knows how to ship on time. [..] We didn't think that everyone else was producing garbage but, we also didn't assume that we couldn't produce something comparable to what we could buy for a tenth of the cost. from https://danluu.com/nothing-works/ https://danluu.com/nothing-works/

brabel 1y ago
After many years using libraries without any sort of vetting process, I completely agree in principle that most code out there is bug infested garbage. One dependency had a concurrency bug so severe it almost cost our company our biggest customer early in our journey. We forked and completely rewrote the library as after looking at the source it was clear they didn’t have nearly as much care with their code as we did. This was the worst case but we faced many bugs in widely used libraries. We can’t replace them all as time is short but if we could we would probably replace most of them.

fmajid 1y ago

Dependencies introduce risks, but not using them at all puts you at a competitive disadvantage against those who are using them and thus achieve faster development time and time to market. What you need is a process to manage dependencies: 1) Only consider open-source dependencies. 2) Introducing new dependencies requires a review. Not just a code review on the pull request introducing it, but checking the license, estimating how much work it would be to rip out, auditing it for history of security vulnerabilities or bugs, whether it is live and still gets updates, how vibrant the community is, and so on. 3) If possible, review your dependencies for possible security issues. Doing this at scale is expensive and the economics of this are still an unsolved problem (I have my ideas: https://blog.majid.info/supply-chain-vetting/ https://blog.majid.info/supply-chain-vetting/). 4) Do not adopt a dependency you are not willing and able to take over the maintenance of, or fork if necessary. At a minimum, it means you have built it from source at least once, not just used binary packages maintained by someone else. 5) Preemptively fork all your dependencies. People can and do delete their repos out of pique, see left-pad.

dotancohen 1y ago
This is amazingly insightful, thank you. I'm going to copy this to my own procedures files, on every dependency I use in the future. The only problem I really see is very tall dependency trees, seen in e.g. the JavaScript world.
chii 1y ago
Both 4) and 5) are very important, but often forgotten. Even for my own personal (small) projects, i've gotten hit with problems when i take an extended leave of absence and then return to a project, only to find my dependencies have become either completely outdated and unusable, or the repo was entirely deleted (with only a remote copy to build with). I've since adopted the "fork" method; the dependency's source is forked (privately), and get the dependency built; this is recursively done with their dependencies (stopping at the language level libraries), just to get familiar with their build chain. Only then, will i feel good enough to add the dependency to my project (and use their publicly released artefacts from their publicly hosted library repository). It's a bit of work, but i think this effort is spent upfront, and removes future effort if the project lives long enough to see the ecosystem move/change directions (and you dont want to follow). Sometimes i do find that source libraries (rather than pre-built binaries) to be better in this sense. I merely need to fork and link the sources into the project, rather than have to learn anything about build chains of dependencies...

eviks 1y ago

> Sometimes it's easier to write it yourself than install the dependency... A few examples wouldn't hurt... > Their breaking changes can trigger expensive re-writes of your own code to handle a new interface. Don't update them or NIH-update them just like you'd do with the original NIH code. Still a net win in saving the time for the initial coding > You need to ensure they end up on your clients' machine. Vendoring exists?

moron4hire 1y ago
The tolerance for the amount of time it takes to build a new thing is a lot looser than the tolerance for the amount of time it takes to fix an old thing in production with PMs screaming about down time.
- eviks 1y ago
  Since none of the two alternatives guarantee no downtime bugs in production, you're missing some other factor that would make NIH preferable, like, maybe, testing (which the new thing would have but adding the old one wouldn't because ... tolerance)?

mrkeen 1y ago

Dozens of comments and no mention of DIP yet. You should absolutely use dependencies, and your should be able to tear them out as soon as you don't like them anymore. Including the dependency can even be part of your NIH if you're so inclined. Instantiate two copies of your code (dep/NIH) and test that they behave the same.

phplovesong 1y ago

Database drivers, crypto etc im always "installing", but for 97% of other stuff i tend to roll my own. And when i dont want to reinvent the wheel, i take time to vet the depency. How many LOC? Does it has deps of its own? Is it a maintained library? Can i fork/fix bugs?

deleted 1y ago

[deleted]

midasz 1y ago

Either way you wrap each thing that acts as a dependency, even if it's internal. I treat dependencies another team in my company delivers the same as any other third party dependency. Never use the classes but always just wrap around them in a service or component. When my 'task' is to publish things on a Kafka bus I create a publishing service that takes in an object that I control, only inside that service is there actual talk about the dependency and preferably even that's a bit wrapped. It's easy to go too far with this but a little bit of wrapping keeps you safe.

000ooo000 1y ago

Everybody loves NIH until what gets invented is dogshit. Seriously, it's easy to romanticise the idea but wait until you have to work on something that evolved over a decade without any refactoring or documentation, and worse, the author is a lifer who couldn't ever imagine that their code could use improvement. I'll migrate to whatever silly API react router has cooked up this year over living that again, thanks.

VonTum 1y ago

They could've at least added left-pad as an example of a bad dependency, instead of the cop-out

solatic 1y ago

Author points to TigerBeetle as an example, which I wasn't familiar with, so I went down a rabbit hole. Wow. Yeah. If you're writing a financial ledger transactions database from scratch in Zig, where safety and performance are your top two goals, so that you can credibly handle a million transactions per second on a single CPU core, well, damn right you can't afford to take any risks on introducing any dependencies. Makes absolute perfect sense to me (no sarcasm). But the average developer, writing most line-of-business CRUD systems, well, quite honestly they're not that strong to begin with. Most dependencies may be bug-infested garbage, but they're still higher quality compared to what most developers are capable of. Most companies are bottlenecked by the caliber of talent they can realistically recruit and retain; and internal development standards reflect the average caliber on the payroll. So like most advice you read on the internet, remember, everybody is in different circumstances; and polar opposite pieces of advice can both be correct in different circumstances.

vasco 1y ago
It doesn't even have to be related to quality of developers. Whatever tool chain or product you use, you're using someone else's dependencies. In some places more than others, but most people aren't implementing their own matrix multiplication code, and the ones that are, aren't implementing random library #24 which isn't in their core business. So this whole discussion happens on black and white terms when in fact people only care if they have regulatory obligations, or they have a particular personal interest in implementing something, or they got attached to that idea for a specific library. But nobody is applying this fully or they'd still be at the beach collecting sand.
- jorangreef 1y ago
  We apply this pretty much fully at TigerBeetle [1]. Reason being that TigerStyle is not only about shipping safer software, but shipping it in less time [2], factoring in the Total Cost of Ownership to end users. In other words, not only optimizing our development time, but also all the time spent in production with subsequent fixes. [1] https://tigerbeetle.com/blog/2025-02-27-why-we-designed-tigerbeetles-docs-from-scratch/ https://tigerbeetle.com/blog/2025-02-27-why-we-designed-tige... [2] https://www.youtube.com/watch?v=w3WYdYyjek4 https://www.youtube.com/watch?v=w3WYdYyjek4

iamsaitam 1y ago

One huge overlooked advantage of using dependencies is knowledge transfer. Software projects (for the moment) require people to write them and people move between jobs. There is a lot of common requirements between different software applications, it would be terrible if everyone just relied on what the standard lib offers. PS: I assume this would be akin to soviet communism, where the state gives you "everything" and the rest you fashion at home. (being extremely loose here, do forgive me)

VonTum 1y ago

For me the "should I use a library for this" comes down to if I want to be able to dip under the abstraction. For instance: terminal color codes. I'm building for linux, but would like my code to be reasonably portable to other platforms. By inserting my own \033[m... Codes, I take responsibility for doing colors on other platforms too, whereas a dependency absolves me of that. On the other hand, if I need a graph algorithm like Bellman-Ford, I don't want to reach for a library, because that immediately forces me to use their structs for every graph node. I might also want to tune BF specifically to my graph's shapes, etc.

wink 1y ago
Interestingly I've only ever ran into this problem (as being a problem) in Advent of Code - you need a certain (more exotic) graph algorithm and you only find an example that goes contrarian to your current model. At work I don't seem to need these weird algorithms, or they are in the language's standard library/default math or graph package and it's not worth reimplementing anyway.
account42 1y ago
> whereas a dependency absolves me of that Except it doesn't. Users don't care if the reason something is broken on their platform is your own code or a dependency. IME platform abstractions often tend to be a trap because they can only abstract 90% without making compromised whereas if you do it yourself you can pierce the abstraction for the remaining 10% and get the best result on all platforms.

zelphirkalt 1y ago

Recently I had a good time avoiding a few dependencies. I am developing a project using Django and it go to a size, where I felt I should add testing to it. But to test things, I would need instances of model classes. However, I didn't want to have to specify all the required fields every time I needed an instance for a test. The fields might be mandatory, but not always relevant for each test. Such a field needs to be filled, but not necessarily by me in the test code. I knew from earlier projects, that Faker generates random data and in the past I have thought it shouldn't be difficult to write a thing that generates random strings and numbers and ids for fields, and recursively other required entities. So I decided to write it myself [1], rather than introducing factory boy and faker as dependencies. Sure those libraries will have a lot more features, but my code is simple and does what I need and I gained additional understanding of the complications with Django's model handling. I also suspect, that factory boy has to hack around some issues, that I avoided by always creating entities in the database, which most of my code is doing anyway. I am not sure how they solved creating instances of models, that have many to many fields without persisting the entities in the database for example, because Django raises an error when one tries to do set a value for such a many to many field, without storing the entity in the database first, so that it gets an id. Which makes sense. So I suspect there is quite some magic in that dependency, that I don't need for now. What's more is, that my factory functions are just as easy to use, if not easier. I simply do `factory_for_model(MyModel)(kwargs)`. It is also easy to add more functionality like `gen_multiple(factory, count)` for example. Uniqueness is more difficult, due to how Django's fields and models are compared. But as far as I understand neither does Faker do uniqueness out of the box. I may be wrong about that though. I also developed a decorator for pytest functions, that helps me avoiding long test names and instead puts a test description in the decorator arguments. Those sentence long test names have previously annoyed me and always caused linting to attack me for it. [1]: https://codeberg.org/ZelphirKaltstahl/web-app-vocabulary-trainer/src/commit/500233e9d40413307889a98058a0e9906d883ecd/site/voctrain/tests/factories.py https://codeberg.org/ZelphirKaltstahl/web-app-vocabulary-tra...

m000 1y ago
Test-only dependencies should be maintained separately from functional dependencies. For standardized things like testing, I'm not sure if DIY makes sense. Even if you use 10% of its capabilities, sticking with an established test framework makes your codebase more maintainable and easier for others to contribute to.

nc0 1y ago

NIH is cool and all for greenfield projects but please remember that most of industrial work today is compatibility with old standards and behaviors, dealing with their bugs and edge cases. In that case, a third-party dependency that has been existing for 20 years will be better.

eapriv 1y ago
If you have a third-party dependency that survived for 20 years. But what if you are trying to choose what to rely on today, and to decide if it will even exist in 20 years? Certainly none of the fashionable JavaScript frameworks will.

panstromek 1y ago

I find both the article and the title a bit too simplistic for the topic. This is the classic "build vs buy" problem and I think it's one of the hardest problems in softare development and maybe engineering in general. I've been bitten by both sides of the decision many times and apart from trivial cases (like `is-even`), it's hard to come up with universal rule of thumb to decide this, especially for cases where it matters.

danesparza 1y ago

I mistakenly read the article thinking it was about the National Institute of Health. :-(

0x000xca0xfe 1y ago

NIH can also be great if you only need a subset of a "mature" dependency but you need to really nail it. Since it is a solved problem you'll likely find ample documentation, algorithms and code examples so there is much less that can go wrong than in a greenfield project. At my last job we rewrote InfluxDB as it as was too resource-hungry for our embedded device and the result was fantastic. 10x the time series storage at a fraction of the memory and CPU utilization, much more robust and flash-friendly.

cmsj 1y ago

I'm honestly increasingly skeptical of any third party dependencies as I age through my career. Before I'll agree to depend on a build tool, package or library, I either need to be convinced that: 1) It has a good chance of a decently maintained future 2) The blast radius of replacing it would be acceptable

Cthulhu_ 1y ago

There's also the distinction between a library - a tool that does one particular thing and does it well - and a framework - which dictates how you structure your entire application. And this is a mindset as well. I mainly know the original quote in the context of Go, where the community as a whole (or at least the part that is in the Slack server) eschews big frameworks in favor of the standard library, lightweight architectures, and specialized libraries. A lot of people coming from other languages come into the communities and ask about whether there's anything like Spring for Go. Another common request is help with a major framework or abstraction like Gin (web API framework) or GORM (database ORM). But Gin is no longer really necessary as the SDK has good support for the common web API use cases, and GORM quickly breaks down as soon as you need anything more advanced than querying a single table, not to mention it's big and complicated but has only one lead developer (I believe), no major organization behind it. But Gin and GORM dictate how you structure at least part of your application; especially the latter adds a layer of indirection so you no longer have to ask "how to I join two tables in SQL" but "how do I join two tables in GORM", the latter of which becomes very specialized very fast. Anyway. Using the standard library is preferable, using small and focused libraries for specific problems that aren't solved by the standard library is also fine. Copy / pasting only the functions you need is also fine.

nyeah 1y ago

Awesome! A literal actual debate between absurd humongous dependencies and the known dumbness of "Not Invented Here". Pick a wrong side folks. (No, "respect for reality" doesn't count as a side. Try again.)

tacker2000 1y ago

So after 2 mins i figured out what NIH means. Would be nice to at least explain it once at the beginning thought. There are many articles that use acronyms and not everyone knows WTH is going on.

a3w 1y ago
"New, in-house" development? Would be my guess. Still left guessing.
- anthomtb 1y ago
  "Not Invented Here". My American brain, of course, immediately went to "National Institute of Health" and thought this was a software developer opining on the current administrations distaste for federal funding of anything.
- a_e_k 1y ago
  https://en.wikipedia.org/wiki/Not_invented_here https://en.wikipedia.org/wiki/Not_invented_here
- deleted 1y ago
  [deleted]

the_real_cher 1y ago

What is NIH? I couldn't find it in the article

ijlx 1y ago
"Not invented here." Refers to the tendency to avoid using things from outside one's company/organization.

nijave 1y ago

>Often they're so large and complex that simply writing the functionality yourself is faster than learning. Sometimes it's easier to write it yourself than install the dependency... Sometimes for good reason. Re-implementing something like HTTP with TLS is non-trivial and surely not easier to rewrite yourself... On the other hand, left-pad.

PaulHoule 1y ago

I can't say I am that impressed with ECMA-48. Back when it was VT-100s connected to a VAX or logging into a BBS over a 9600 baud modem with a PC I felt satisfied. Even when there was a bit of line noise. Ever since 1990 or so when it has been using "telnet" or the equivalent on an xterm or CMD.EXE or some other GUI application that emulates I've never trusted it to work 100% right. Maybe 99.5%, but I expect the cursor to be a column off where it is supposed to be, for there to just be a little misalignment here and there. I mean, other people don't complain, but people don't complain when the center channel is burned out at the cinema or when the Linux desktop has a 179px wide label in a 59px wide space and such. It's one reason I gave up on emacs and just use the 20% of vi functionality I know (hit 'i' and pretend that it's Notepad, as least ESC + :wq doesn't confound my muscle memory for ^S being search the way ^S and ^X^S do) when I am logged into a busted Linux install to get the package manager running again but really use IntelliJ IDEA as much as I can.

mtlynch 1y ago

>Instructive here is Tigerbeetle, a financial database written entirely with Vanilla Zig: How does TigerBeetle's existence support the argument that rolling your own dependencies is better than using off-the-shelf tools? TigerBeetle has existed as a company for less than three years, they haven't reached a 1.0 release, and they have a single-digit number of engineers. As far as I can tell, they haven't even reached the point of self-sufficiency, as they raised another round of VC funding a year ago. The pain of rolling your own tools happens as you grow and your needs change. Rolling your own static site generator[0] is fine when you only have a handful of engineers, but I suspect over time, they'll burn more time on their homegrown HTML templating solution[1] than if they had just used a battle-tested, off-the-shelf solution like Hugo. The only dependency TigerBeetle accepted is Zig, which also hasn't reached a stable 1.0 release and frequently forces developers to rewrite their code to deal with breaking changes, including a major one coming in Zig 0.15.0.[2] I like TigerBeetle, but they're not proof of anything yet. For every TigerBeetle, there are a hundred profitable companies whose entire business depends on WordPress with 50 plugins they picked at random. Aside from TigerBeetle, I find most of the arguments in this article weak. They sound like rationalization for a developer who enjoys rolling their own tools and seem not to consider actual business value. The article also leaves out what I think is the most important consideration in evaluating dependencies: lock-in. How difficult is it to swap out this dependency later? Because if the answer is, "very easy" most of the other considerations don't matter. There's no use doing an exhaustive survey of image processing libraries when you can swap out your choice with a few hours of dev work. But choosing something like a storage backend is very difficult to change later, so you want to put more thought into it. [0] https://tigerbeetle.com/blog/2025-02-27-why-we-designed-tigerbeetles-docs-from-scratch/ https://tigerbeetle.com/blog/2025-02-27-why-we-designed-tige... [1] https://github.com/tigerbeetle/tigerbeetle/blob/86b85ab60395dedec8b1c47df062cb2b840c9413/src/docs_website/src/html.zig#L21-L72 https://github.com/tigerbeetle/tigerbeetle/blob/86b85ab60395... [2] https://github.com/ziglang/zig/pull/24329 https://github.com/ziglang/zig/pull/24329

jorangreef 1y ago
> How does TigerBeetle's existence support the argument that rolling your own dependencies is better than using off-the-shelf tools? At least from my own experience, without TigerStyle [0], there's no way we could have shipped TigerBeetle from 0 to production in 3.5 years, with the same quality, and to the same tolerances: https://jepsen.io/analyses/tigerbeetle-0.16.11 https://jepsen.io/analyses/tigerbeetle-0.16.11 Whereas, for example, if we'd used off-the-shelf dependencies such as Raft or RocksDB, it would have been a nightmare, and taken longer, just to fix them up to solve our storage fault model and implement Protocol-Aware Recovery correctly. Even then, we'd have been stuck with a systems language of the last 30 years (C/C++), when we could have invested in a language for the next 30 and with a more powerful toolchain. Of course, we'd also have been without Deterministic Simulation Testing, because most software dependencies are typically not designed for DST. But finally (and to your point about sustainability), without TigerStyle, we wouldn't have had the company, or the investment, team, and customers we have today, or be as far along financially. Not saying that you need to share our engineering philosophy. But it works for us. [0] https://www.youtube.com/watch?v=w3WYdYyjek4 https://www.youtube.com/watch?v=w3WYdYyjek4

ChrisMarshallNY 1y ago

Well, as a battle-scarred old war horse, I can say that "It Depends™." I have found that "It Depends™" is a mantra for almost everything that I do, and experience has given me the ability to choose a fork in the road, when an "It Depends™" moment happens. When I was younger, my world was governed by "hard and fast" rules. There could be no exceptions, and some of the worst code I wrote, consisted of the gymnastics required to shoehorn an unsuitable library/paradigm into my projects. I tend to use a lot of self-developed dependencies. They are really distillations of things that I do frequently, so I factor them into standalone packages. That way, I don't have to reinvent the wheel, and I'm confident of the Quality and provenance. But if there's functionality that is required, and beyond me, for whatever reason, I am always open to including dependencies, as long as I can reconcile myself to their quality and other issues.

compiler-guy 1y ago

This echoes the Joel On Software Classic, "In Defense of Not-Invented-Here-Syndrome", which gives some of the reasons Microsoft Excel won the spreadsheet wars. Of particular note: =-=-= “The Excel development team will never accept it,” he said. “You know their motto? ‘Find the dependencies — and eliminate them.’ They’ll never go for something with so many dependencies.” https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-invented-here-syndrome/ https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-...

anthomtb 1y ago

> One of the biggest fallacies in coding is that dependencies have zero downsides. Am I the only one who hates when articles start with a strawman like this? Or does the author of TFA really know people who think dependencies have zero downsides? Just the word "dependency" brings to mind infantile helplessness. I cannot believe anyone is out there opining a lack of downsides.

iainctduncan 1y ago

I do technical diligence on companies getting purchased or invested in, largely by private equity. Previous to that I was a developer for 15 years (still am, but open source now). One big one not touched on in the article is the cost of security updates. I see this all the time... companies that are in a bad position because they have too many dependencies and have wound up unable (for business reasons) to dedicate adequate resources to keeping them all current, and then end up with past EOL deps with published vulnerabilities. This – literally – costs them a lot at acquisition time. The purchaser (who is typically very risk averse) factors in all the cost to get things up to date and takes it off the price. This can be very significant. (looking at you, React et. al!) On the other hand, I've seen companies where they used as little in deps as they could get away with, and they wind up in very strong positions. There really is a big labour cost in chasing the latest versions of underlying frameworks when those move too fast.

vincent-manis 1y ago

I take neither side in a dependencies vs NIH war. I like using SQLite as a database, and I use Tk (of Tcl/Tk) as my user interface toolkit, for example. Neither of those is going anywhere, they are both maintained, and I build them myself. I would argue that the right way to think about dependencies, as some have alluded to, is to do a risk/benefit analysis. On the benefit side, how much work would it take me to duplicate this component, how well will it suit my needs, and so on. On the risk side, everything from continued maintenance to security and licence issues (for both free/libre/open-source and proprietary components). Then risk/benefit asks for ways of ameliorating risk, such as by forking code, or paying for support. The right way to think of adding a dependency is to ask and answer questions like this prior to adding it. This is not the way that JavaScript developers used left_pad, they just said “it's in npm, so it's good.”