▲ | rgoulter 4 days ago | |||||||
In the article, the author does say "I am not advocating to write things from scratch", while also describing third party dependencies as liabilities (e.g. security vulnerabilities), that people are too trusting of third party dependencies, that people overestimate the quality of third party dependencies. I think you're splitting hairs if you're saying that these points from the article argue against package managers but don't argue against using third party dependencies. I similarly think you're splitting hairs if to consider "package managers are useful?" and "third party dependencies are useful?" as distinct points. | ||||||||
▲ | 1GZ0 3 days ago | parent [-] | |||||||
Liability: "Something for which one is liable; an obligation, responsibility, or debt." Third party dependencies absolutely are liabilities. You are liable to vet them, inspect their licenses and keep them updated while ensuring that they continue working with your existing code. This is not something package managers help you do. Package managers like NPM make it trivial to skip these steps entirely. What is being argued for, is a more thoughtful approach to handling third party dependencies. Or at the very least, the need for people to realise that there are costs associated with bringing third party dependencies into your codebase. Its not splitting hairs at all. Its more of an presumption on the part of a large number of readers, that the 2 points argued conflate to "Package manager suck, because third party dependencies suck and you should write everything from scratch instead". | ||||||||
|