|
I never argued there wasn't. In fact the only reason I didn't bring it up is because it's a painfully obvious point that I felt didn't need to be reiterated. Also, water is wet.
If you're going to discuss the costs and implications of using dependency libraries, you do also need to discuss the opposing side of costs and implications of building your own. Just because it's obvious doesn't make it any less a credible argument, companies are not going to be okay with their development teams spending weeks or months building software packages which already exist out of the box.
Just because "there's a risk" when using a third-party library doesn't offset the enormous costs involved with rolling your own. Heck, even if you did roll your own version, there's a strong chance you'd be introducing your own bugs and security issues. Libraries and frameworks which do provide infrastructure (ie. for web, Django, Spring, ASP.NET, Laravel) get regularly tested and probed for CVEs, which isn't something you'd have for a home-grown library.
I wish that was true. God, how I wish that was true.
Every company I've worked with has done this, and companies my friends work for do this. In all the open-source projects I've used, they have code review processes in place which analyse whether changing dependency versions might cause problems. Unit and integration tests are there to test these sorts of things too. I'm not saying everyone does this, it's down to the individual teams and people. It sounds more like you've had personal experience with a couple of bad actors, and are projecting this onto the wider development community.
Just because people are publishing packages out doesn't mean you have to use them. There are a lot of silly solutions to non-existent problems, and a lot of libraries which duplicate things already. But this just leans into the original problem: why are people re-inventing the wheel when there are libraries out there that do the job anyway? It's because some people have this mindset of "I know that library does what I want, but I think I can do it better/I don't like how they did it so I'll make my own", or they feel like they have something to prove and need to build it from scratch.
If you don't think about what you are writing, you are not writing software, you are free association babbling.
And there-in lies what I believe is the underyling tone of this thread. This comes off as saying "If you don't write the software yourself then you're not a real software developer". This isn't even remotely true. In fact, a good developer knows how to best leverage the existing tools available to accomplish what they need. There's absolutely nothing wrong with leaning on existing frameworks and libraries to build what you need to build.
In my previous job I wrote a piece of software designed to issue invoices out to customers, and it processed hundreds of thousands of invoices every day. This included uploading them to cloud storage, updating the customer portal with the invoice details, issuing out emails to the customers, updating internal systems with audit information. I built all of this using existing frameworks (Spring Boot, AWS SDK, Apache Camel, etc.) and it was an incredibly powerful and complex piece of software, but does this mean I did nothing more than free association babble? Am I any less of a software developer because I didn't take the time to build my own cloud infrastructure and asynchronous message processing engines? Drat, I didn't write my own distributed bucket-lock-based SQS, I relied on AWS to provide that for me.
|
|
|
|
|
Nope. It's not that at all.
It's just using dependencies or not should be a thoughtful choice.
For too many people it's not.
I get that you think that's not the case.
What I've seen says your thinking is not in line with the actual applications that are out there. Particularly on the web.
I don't care if you agree. You wanted your argument and you got one.
Meanwhile I said what I came to say.
Pretty much everyone on this thread got it save you.
I'm done.
Check out my IoT graphics library here:
https://honeythecodewitch.com/gfx
And my IoT UI/User Experience library here:
https://honeythecodewitch.com/uix
|
|
|
|
|
honey the codewitch wrote: then it sounds a whole lot like you don't acknowledge that there is effort, work and compromise in managing external resources, not just internal resources. There are plenty of reasons not to use dependencies depending on what it is, and the situation.
I like anti-lock brakes and all wheel drive on my car.
And I absolutely adore the back up camera.
Yes, they are more complex. And definitely more expensive. I can't imagine what it would cost to fix that camera if someone runs into the back up my car but I know it would take very little to destroy it.
But no way am I going to roll my own.
And no way I am I going to look for a Model-T just because it was far simpler.
For that matter I like the lighter I bought just to start my outdoor BBQ. No way I am going to start rubbing two sticks together.
|
|
|
|
|
This isn't about that.
It's about not putting truck nuts on your sedan just because you saw them on amazon.
The choice to use a dependency or not should be a thoughtful one. Not *google google google* "PAY DIRT!" *click!*
It isn't complicated.
Check out my IoT graphics library here:
https://honeythecodewitch.com/gfx
And my IoT UI/User Experience library here:
https://honeythecodewitch.com/uix
|
|
|
|
|
This statement proves my view that most people who call themselves 'developers', 'programmers', 'coders', whatever, shouldn't be developers. They should stop immediately and go become accountants or estate agents.
|
|
|
|
|
Eee-yah. 
|
|
|
|
|
Earlier this week I needed something to quickly decode a string - I don't know how this string I'm handed has been encoded, but I know it's part of some well-supported standard. Anyway, I did find a NuGet package that had the function to break it apart, but it had its own set of dependencies - it brought along 8 new packages (!)...some of which I was already using, but still - had it not been for time, I would've been very, very tempted to roll my own. I held my breath in disgust and they're now part of my solution file...but every time I look at it, I can't help but go " "
|
|
|
|
|
How do you know it's correct? How well does it react to corrupt data? 
I would learn the "well-supported standard" well enough to at least make a rough version of the encoder and decoder, and then compare inputs and outputs between the two. Once you have that in place, if they agree and unless it's seriously slower than the reference implementation, just use yours.
I'd be interested in knowing more about this "well-supported standard" -- last year I had to implement a JSON parser which could detect and react to certain imperfections in some files we were receiving from a third-party utility.
|
|
|
|
|
PIEBALDconsult wrote: How do you know it's correct? How well does it react to corrupt data? 
I don't. And I don't have the resources to investigate.
All I know is that it's a library Microsoft wrote, so I have to trust it (as far as I can trust Microsoft). I'm still not going to name names to protect the innocent.
|
|
|
|
|
dandy72 wrote: a library Microsoft wrote
I'd put money on it then.
dandy72 wrote: not going to name names
 I would have welcomed the exercise.
|
|
|
|
|
dandy72 wrote: Earlier this week I needed something to quickly decode a string
For something similar to which I knew how to write the code, the very best solution I found pulled in hundreds of dependencies. It was part of a much larger application. No way I was comfortable with that so I just rolled my own code.
|
|
|
|
|
Totally agreed. I'll have a look at the actual implementation and, if I'm allowed the time, just might roll my own as well...
|
|
|
|
|
You know my stance. I roll my own.
I haven't yet run into a situation where I wasn't able to write what I need just with what's in .net itself -- or things like Oracle's own .net provider.
Third-party solutions don't appeal to me. Not to forget that any third-party packages had to be approved by corporate and that could take months.
I will say that I have dabbled with EPPlus and AngleSharp (both fine products), just to see what they offered, but never used them for anything that went into production. I don't recall either having other dependencies.
Personally, I see dependencies as red flags.
|
|
|
|
|
honey the codewitch wrote: with the state of software development these days.
These days? Versus when?
Like when they first attempted to re-write the airline reservation system and managed to end up with a failed project and something like 10+ million (or billion) dollar lawsuits?
Or when they released a CPU that had a bug in the floating point library.
Or the space craft that had to be destroyed after taking off.
Humans are fallible. That is true now and always has been. Complexity in no way helps with that.
|
|
|
|
|
Versus when software did not have 150 dependencies for an online guest book
Check out my IoT graphics library here:
https://honeythecodewitch.com/gfx
And my IoT UI/User Experience library here:
https://honeythecodewitch.com/uix
|
|
|
|
|
Nothing that AI can't fix. . . but I guess that scares me more.
|
|
|
|
|
I am going to retire next year and it won't be soon enough, partly because of what you are talking about. After 50 years of working on computer systems, I think I will progress to home craft activity.
|
|
|
|
|
I use as few dependencies in my project as possible.
In my current, rather large project, the only actual dependency I am using is for Syncfusion's WPF control suite.
I have an additional Open Source project, which I ported to VB.NET so all of my source is consistent (it is an Open Source project) and the Firebird Database Provider, which I also include the source code for. This latter project is in C# and is the only one I decided not to port since most people would not be looking at it anyway. However, it is compiled with the rest of the project so that if I want to upgrade my framework version, there are no issues.
When I upgrade the database engine to the latest version, I will probably just use the DLL for the data provider.
All this being said, I attempt to minimize project dependencies as much as possible since they can and do cause issues when updating and\or upgrading one's project.
As one who came out of the mainframe environments we all learned one thing about our coding and project infrastructures... Keep it as simple as possible so the least experienced member of a team can quickly come up
to speed with the project.
Today, however, many developers seem to regale as to how complex they can make their code and project infrastructures by using much of then newer and arcane coding constructs, which really do very little for performance in most cases while making the source code more ambiguously complex. At the same time, projects are no longer offered as separate versions on a per framework basis but are all combined into one solution with a lot of directives to produce all of the necessary assemblies on a per framework separation. All this makes a project difficult to read and understand...
Steve Naidamast
Sr. Software Engineer
Black Falcon Software, Inc.
blackfalconsoftware@outlook.com
|
|
|
|
|
One of the great/horrible things about node dependencies is that sub-dependencies can be interdependent so if your code uses version 5 of a library and your dependency uses version 3, you will end up with both version 5 and 3 loaded independently in your app. I've wasted so much of my life attempting .net dependency updates and just giving up because nothing is actually broken yet.
|
|
|
|
|
I haven't quite figured out what language it thinks I should be using, but all my English words are red-lined now. No idea how this happened, checked my language preferences and they are US-English, refreshed the browser page multiple times. Well, I guess for bugs, its fairly benign, not like it launched nuclear missiles, and I'm almost the point where my brain is ignoring all the red-lining. 
|
|
|
|
|
Oh, I do say Ole Boy, There is only one right and proper English in this world and that is the Kings English. Ones spell checker should always respect and reflect that simple fact. It is such a trifling and awfully embarrassing proposition you make that it should represent anything from the uncivilised colonies.
A Fine is a Tax for doing something wrong
A Tax is a Fine for doing something good.
|
|
|
|
|
RossMW wrote: Ole Boy
RossMW wrote: he Kings English
RossMW wrote: Ones spell checker
I guess they don't teach either spelling or grammar down your way. 
|
|
|
|
|
Nah. Just cussing. Thats all we need
A Fine is a Tax for doing something wrong
A Tax is a Fine for doing something good.
|
|
|
|
|
Marc Clifton wrote: Well, I guess for bugs, its fairly benign
Untill you sent the documentary too you're customer
|
|
|
|
|
Sander Rossel wrote: customer costumer
FTFY.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
