31–40 of 59 posts
Earlier quoted context omitted.
Sure. Lot's more debugging than using something battle tested, which is why I have this in my CLAUDE.MD: > If there is a battle tested, well known package that can help us, then recommend it BEFORE implementing large swaths of custom code.
This is hilarious .
I disagree. Every python package we install seems to install dozens of libraries, each of which can could harbour malware. Many of them are only used for a single function within them. We have no idea of what most of the packages are for. It's a lot.
https://en.m.wikipedia.org/wiki/Log4j https://en.m.wikipedia.org/wiki/Npm_left-pad_incident Languages and domais that have leaned too faar into package managers and small libraries are prone to fragility and security nightmares. For any "serious" application of critical code; every library used need to be vetted and verifierad to be maintained and secure. Id much rather deal with a bug in our code than a depricated l…
A project only become serious once legal is breathing down engineering's neck. Before that, it's usually the far west. After, it becomes a security circus trying to patch the technology deficiency (custom registries, complex linting and other analysis tooling,...)
I disagree. Every python package we install seems to install dozens of libraries, each of which can could harbour malware. Many of them are only used for a single function within them. We have no idea of what most of the packages are for. It's a lot.
LOL! I thought the article was going to be about reading books and ChatGPT! And yes, I agree. https://www.npmjs.com/package/boolean >converts lots of things to boolean. >3 million weekly downloads This is insane.
Unrelated: I initially expected this articles to be referring to public libraries. I think that would be a challenging connection to prove despite it making intuitive sense. On the article: some use cases eg handling dates, fault tolerant queues have so many edge cases and are so mission critical that relying on a battle tested tool makes a lot of sense. However, in my career I’ve seen a lot of examples of a package…
I thought this was about physical libraries as well. Maybe the link is librarians, supposedly if you didn't even know where to begin searching a trained librarian would have been a good person to ask.
I disagree. Every python package we install seems to install dozens of libraries, each of which can could harbour malware. Many of them are only used for a single function within them. We have no idea of what most of the packages are for. It's a lot.
LOL! I thought the article was going to be about reading books and ChatGPT! And yes, I agree. https://www.npmjs.com/package/boolean >converts lots of things to boolean. >3 million weekly downloads This is insane.
I disagree. Every python package we install seems to install dozens of libraries, each of which can could harbour malware. Many of them are only used for a single function within them. We have no idea of what most of the packages are for. It's a lot.
https://en.m.wikipedia.org/wiki/Log4j https://en.m.wikipedia.org/wiki/Npm_left-pad_incident Languages and domais that have leaned too faar into package managers and small libraries are prone to fragility and security nightmares. For any "serious" application of critical code; every library used need to be vetted and verifierad to be maintained and secure. Id much rather deal with a bug in our code than a depricated l…
(or "naïve")
A bit of duplication is better than a lot of dependency.