> You cannot reasonably expect developers to package and maintain all their dependencies properly. I think that this is a good point, but it all comes down to

> You cannot reasonably expect developers to package and maintain all their dependencies properly. I think that this is a good point, but it all comes down to quality control. You wouldn't accept a new dependency into your project if it is buggy or has a bad API. So why is bad packaging, a hacked-up build system or inability to build from an auditable source considered acceptable in many communities today?