3 ms·

People were also dismissing concerns about build tooling automatically pulling in an entire swarm of dependencies and now here we are in the middle of a repetit

People were also dismissing concerns about build tooling automatically pulling in an entire swarm of dependencies and now here we are in the middle of a repetitive string of high profile developer supply chain compromises. Short term thinking seems to dominate even groups of people that are objectively smarter and better educated than average.

culopatin 7mo ago
If anything I feel more in control of these agents than the millions of LOC npm or pip pull in to just show me a hello world
- Sindisil 7mo ago
  The load bearing word being "feel".
tokioyoyo 7mo ago
> “high profile developer supply chain compromises” And nothing big has happened despite all the risks and problems that came up with it. People keep chasing speed and convenience, because most things don’t even last long enough to ever see a problem.
- fc417fc802 7mo ago
  I've yet to be saved by an airbag or seatbelt. Is that justification to stop using them? How near a miss must we have (and how many) before you would feel that certain practices surrounding dependencies are inadvisable? A number of these supply chain compromises had incredibly high stakes and were seemingly only noticed before paying off by lucky coincidence.
  - tokioyoyo 7mo ago
    > How near a miss must we have (and how many) The fun part is, there have been a lot of non-misses! Like a lot! A ton of data have been exfiltrated, a lot of attacks, and etc. In the end... it just didn't matter. Your analogy isn't really apt either. My argument is closer to "given in the past decade+, nothing of worth has been harmed, should we require airbags and seatbelts for everything?". Obviously in some extreme mission critical systems you should be much smarter. But in 99% cases it doesn't matter.
  - hiq 7mo ago
    > I've yet to be saved by an airbag or seatbelt. Is that justification to stop using them? By now, getting a car without airbags would probably be more costly if possible, and the seatbelt takes 2s every time you're in a car, which is not nothing but is still very little. In comparison, analyzing all the dependencies of a software project, vetting them individually or having less of them can require days of efforts with a huge cost. We all want as much security as possible until there's an actual cost to be paid, it's a tradeoff like everything else.
    - franktankbank 7mo ago
      The funniest part is that it always gets traded off, everytime. Talking about tradeoffs you'd think sometimes you'd keep it sometimes you'd let it go, but no, its every goddamn time cut it.
    - fireant 7mo ago
      It's true that it takes 2 seconds to fasten a seatbelt but it still had to be mandated by law before most people started actually doing it
totallymike 7mo ago
“Objectively smarter” is the last descriptor I’d apply to software developers
- fc417fc802 7mo ago
  My intent was to cast a very wide net there that covers more or less all expert knowledge workers. Zingers aside software developers as a group are well above the societal mean in many respects.
vkou 7mo ago
Objectively smart people wouldn't be working so hard at making themselves obsolete.
matheusmoreira 7mo ago
It's hard to think long term when your salary depends on short term thinking. I keep seeing horrifying comments from all sorts of people saying they'd be fired if they stopped using AI to bang out ridiculous amounts of code at lightning speed.

culopatin 7mo ago

If anything I feel more in control of these agents than the millions of LOC npm or pip pull in to just show me a hello world

Sindisil 7mo ago
The load bearing word being "feel".

tokioyoyo 7mo ago

> “high profile developer supply chain compromises” And nothing big has happened despite all the risks and problems that came up with it. People keep chasing speed and convenience, because most things don’t even last long enough to ever see a problem.

fc417fc802 7mo ago
I've yet to be saved by an airbag or seatbelt. Is that justification to stop using them? How near a miss must we have (and how many) before you would feel that certain practices surrounding dependencies are inadvisable? A number of these supply chain compromises had incredibly high stakes and were seemingly only noticed before paying off by lucky coincidence.
- tokioyoyo 7mo ago
  > How near a miss must we have (and how many) The fun part is, there have been a lot of non-misses! Like a lot! A ton of data have been exfiltrated, a lot of attacks, and etc. In the end... it just didn't matter. Your analogy isn't really apt either. My argument is closer to "given in the past decade+, nothing of worth has been harmed, should we require airbags and seatbelts for everything?". Obviously in some extreme mission critical systems you should be much smarter. But in 99% cases it doesn't matter.
- hiq 7mo ago
  > I've yet to be saved by an airbag or seatbelt. Is that justification to stop using them? By now, getting a car without airbags would probably be more costly if possible, and the seatbelt takes 2s every time you're in a car, which is not nothing but is still very little. In comparison, analyzing all the dependencies of a software project, vetting them individually or having less of them can require days of efforts with a huge cost. We all want as much security as possible until there's an actual cost to be paid, it's a tradeoff like everything else.
  - franktankbank 7mo ago
    The funniest part is that it always gets traded off, everytime. Talking about tradeoffs you'd think sometimes you'd keep it sometimes you'd let it go, but no, its every goddamn time cut it.
  - fireant 7mo ago
    It's true that it takes 2 seconds to fasten a seatbelt but it still had to be mandated by law before most people started actually doing it

totallymike 7mo ago

“Objectively smarter” is the last descriptor I’d apply to software developers

fc417fc802 7mo ago
My intent was to cast a very wide net there that covers more or less all expert knowledge workers. Zingers aside software developers as a group are well above the societal mean in many respects.

vkou 7mo ago

Objectively smart people wouldn't be working so hard at making themselves obsolete.

matheusmoreira 7mo ago

It's hard to think long term when your salary depends on short term thinking. I keep seeing horrifying comments from all sorts of people saying they'd be fired if they stopped using AI to bang out ridiculous amounts of code at lightning speed.