wetdry.world is one of the many independent Mastodon servers you can use to participate in the fediverse.
We are a community focused on gaming, tech, entertainment, and more.

Administered by:

Server stats:

677
active users

@marcan@treehouse.systems I find it somewhat silly that you are disregarding the benefits of depending on code maintained by someone else while pulling out one flaw ("well known stories with Node.js").

I'm an author of a couple of libraries that you would probably say are useless and should be avoided/vendored but improve runtime efficiency and contain some trickery internal code.

@GnomedDev I agree with @marcan [social.treehouse.systems] and as @robpike said: “a little copying is better than a little dependency”.

@sszuecs Real programmers don't simply copy their CPU off of intel, they implement their own bespoke instruction set to avoid maintaining that technical debt!

@GnomedDev @sszuecs you don't understand the trade-off. The "little copy is better then dependency" crowd is not against dependencies in total. But even in eco systems with powerful package managers each dependency has a long term cost. You can't just put renovatebot and happily merge whatever change the Maintainer does. This will give you a free update to cryptominer or worse eventually. So you have to review your dependencies regularly and vet their government/mainterners.

@hikhvar @sszuecs I agree that you should vet updates to your dependencies, but the cost of making sure that your vendored code is updated with the latest upstream changes is less effort than taking a quick look over the diff of a library update.

@hikhvar @sszuecs also, arguing for vendoring for security reasons ignores the fact that you can simply pin the versions of your dependencies and get the same result