Open Source and Saying “No” • Hacker News Board

Re: Open Source and Saying “No”

#141

Post by dncornholio » Tue, Nov 29, 2022, 1:05 PM UTC

acdha wrote: post #56

ilyt wrote: post #40

Earlier quoted context omitted.

That's probably bad example because if you decided that node is a security problem you're fucked as you'd have to change the language you use...

I wasn't saying that Node itself is a security problem but rather that the community is biased towards rapid upgrades, trading long-term API stability for the ability to use new things quickly. That's a valid trade-off which a lot of people have enjoyed but it does mean that you need to think about whether you have the resources to keep surfing that wave when adding new dependencies. It does seem like the community i…

I'm not saying you should blindly install the first package you find. My point is, when a program works, and it's maintainable, there's no problem.

So many message here are saying what could go wrong, but I have NEVER actually run into the issues people seem to imply.

In my opinion, your 'community' is just people who shout hard but hardly do any coding IMHO.

Re: Open Source and Saying “No”

#142

Post by robertlagrant » Thu, Dec 01, 2022, 10:40 AM UTC

orf wrote: post #19

robertlagrant wrote: post #18

Low dependency analysis is one of the reasons I like Flask[0]. [0] https://github.com/pallets/flask/blob/main/setup.py

Weird, I dislike Flask because it quickly becomes a dependency soup the moment you want to add something simple like forms or a DB. Django has less dependencies[1] - one "real" one (asgiref), one to work around a sqlite issue ("sqlparse"), and up to two timezone related backports depending on your OS (tzcata, zoneinfo). Plus obviously a library for your db backend, if you're not using sqlite. And with that you get a…

I don't think it is as soupy as you say.

Flask is split up into a few Pallets projects - Flask, Werkzeug, Markupsafe, Click, itsdangerous, Jinja2 - but they're all from the same stable group. This split makes them more useful as independent libraries, rather than one big framework.

Ditto two more (Alembic and SQLAlchemy) are also from a very stable group. It would be nice if Alembic used Jinja2 instead of Mako, of course, but it's a dev-time dependency and so it's lower risk in my opinion.

I agree that at the thing Django does (forms + a SQL database) it does it with fewer dependencies than Flask. But that doesn't mean Flask has loads of dependencies; it has an appropriate number for the task you're doing. I was more comparing Flask to actual dependency soup ecosystems[0].

[0] https://github.com/rizkimcitra/next-starter-blog/blob/main/p...

Re: Open Source and Saying “No”

#143

Post by Vanit » Fri, Dec 02, 2022, 2:48 AM UTC

Basically the same lesson can applied for saying no to feature requests from clients on your SaaS product; saying yes commits you to ongoing support, and you need to consider if it's worth it, particularly consider if said client is trying to outsource what should be bespoke work on their side, to you.