5 ms·

If you pull something into your project, you're responsible for it working. Full stop. There are a lot of ways to manage/control dependencies. Pick something th

If you pull something into your project, you're responsible for it working. Full stop. There are a lot of ways to manage/control dependencies. Pick something that works best for you, but be aware, due diligence, like maintenance is ultimately your responsibility.

IshKebab 1y ago
That's very naive. We can do better than this.
- hermannj314 1y ago
  Almost all software has a no warranty clause. I am not a lawyer but in pretty plain English every piece of software I have ever used has said exactly that I can fuck off if I expect it to work or do anything. To clarify - I dont think it is naive to assume the software is as-is with all responsibilities on the user since that is exactly what lawyers have made all software companies say that for over 50 years.
  - gmueckl 1y ago
    Product liability is coming for software. Warranty disclaimers in licenses will be rendered ineffective by the end of 2026 at the latest.
    - tcoff91 1y ago
      Source? An open source library is not necessarily a ‘product’ at all.
      - LtWorf 1y ago
        No source because it's not real. There's talk about final products and making the companies selling them responsible. But open source developers are not responsible.
    - respondo2134 1y ago
      this seems highly unlikely. Almost all of the software we're discussing in this context has little or no resources behind it. No lawyers are going to sue an OSS developer because there's no payday.
    - LtWorf 1y ago
      only if you pay for it… otherwise you are liable but don't have anyone else to blame.
  - IshKebab 1y ago
    I'm not sure what your point is. I was saying it's naive to think that everyone is going to review all dependencies, and we can do better than requiring them to.
    - hermannj314 1y ago
      I thought my point was clearly made the 1st time. How can we promise to "do better" when shit like "no author or distributor accepts responsibility to anyone for the consequences of using it or for whether it serves any particular purpose or works at all" is in the legal agreement of the software you are using? Making someone agree to that while simultaneously on the side making promises that the software works is used car salesman gimmicks. The only things that matters is what you put in writing.
      - worik 1y ago
        > How can we promise to "do better" when shit like "no author or distributor accepts responsibility to anyone One way or another that will end. Free Software will have the same responsibilities. If you write software, negligently, and it causes damage, you will be liable I should not be able to make a Crypto wallet that is easy to hack and distribute it without consequence This will be a very good thing We know how to make secure 4eliable software (some of us) but nobody will pay for it
adrianmonk 1y ago
Acknowledging your responsibility doesn't make the problem go away. It's still better to have extra layers of protection. I acknowledge that it is my responsibility to drive safely, and I take that responsibility seriously. But I still wear a seat belt and carry auto insurance.
kelnos 1y ago
Oh I'm well aware, and that's the problem. Unfortunately none of the available options hit anything close to the sweet spot that makes me comfortable. I don't think this is a particularly unreasonable take; I'm a relative novice to the JS ecosystem, and I don't feel this uncomfortable taking on dependencies as I do in pretty much any other ecosystem I participate in, even those (like Rust) where the dependency counts can be high.

IshKebab 1y ago

That's very naive. We can do better than this.

hermannj314 1y ago
Almost all software has a no warranty clause. I am not a lawyer but in pretty plain English every piece of software I have ever used has said exactly that I can fuck off if I expect it to work or do anything. To clarify - I dont think it is naive to assume the software is as-is with all responsibilities on the user since that is exactly what lawyers have made all software companies say that for over 50 years.
- gmueckl 1y ago
  Product liability is coming for software. Warranty disclaimers in licenses will be rendered ineffective by the end of 2026 at the latest.
  - tcoff91 1y ago
    Source? An open source library is not necessarily a ‘product’ at all.
    - LtWorf 1y ago
      No source because it's not real. There's talk about final products and making the companies selling them responsible. But open source developers are not responsible.
  - respondo2134 1y ago
    this seems highly unlikely. Almost all of the software we're discussing in this context has little or no resources behind it. No lawyers are going to sue an OSS developer because there's no payday.
  - LtWorf 1y ago
    only if you pay for it… otherwise you are liable but don't have anyone else to blame.
- IshKebab 1y ago
  I'm not sure what your point is. I was saying it's naive to think that everyone is going to review all dependencies, and we can do better than requiring them to.
  - hermannj314 1y ago
    I thought my point was clearly made the 1st time. How can we promise to "do better" when shit like "no author or distributor accepts responsibility to anyone for the consequences of using it or for whether it serves any particular purpose or works at all" is in the legal agreement of the software you are using? Making someone agree to that while simultaneously on the side making promises that the software works is used car salesman gimmicks. The only things that matters is what you put in writing.
    - worik 1y ago
      > How can we promise to "do better" when shit like "no author or distributor accepts responsibility to anyone One way or another that will end. Free Software will have the same responsibilities. If you write software, negligently, and it causes damage, you will be liable I should not be able to make a Crypto wallet that is easy to hack and distribute it without consequence This will be a very good thing We know how to make secure 4eliable software (some of us) but nobody will pay for it

adrianmonk 1y ago

Acknowledging your responsibility doesn't make the problem go away. It's still better to have extra layers of protection. I acknowledge that it is my responsibility to drive safely, and I take that responsibility seriously. But I still wear a seat belt and carry auto insurance.

kelnos 1y ago

Oh I'm well aware, and that's the problem. Unfortunately none of the available options hit anything close to the sweet spot that makes me comfortable. I don't think this is a particularly unreasonable take; I'm a relative novice to the JS ecosystem, and I don't feel this uncomfortable taking on dependencies as I do in pretty much any other ecosystem I participate in, even those (like Rust) where the dependency counts can be high.