Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Thursday January 24 2019, @10:25PM   Printer-friendly
from the ask-the-PHB dept.

Russ Cox, who developed the dependency/package management system for Go, writes about the problems with software dependencies. A choice excerpt:

Dependency managers now exist for essentially every programming language. [...] The arrival of this kind of fine-grained, widespread software reuse is one of the most consequential shifts in software development over the past two decades. And if we’re not more careful, it will lead to serious problems.

A package, for this discussion, is code you download from the internet. Adding a package as a dependency outsources the work of developing that code [...] to someone else on the internet, someone you often don’t know. By using that code, you are exposing your own program to all the failures and flaws in the dependency. Your program’s execution now literally depends on code downloaded from this stranger on the internet. Presented this way, it sounds incredibly unsafe. Why would anyone do this?


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2, Interesting) by Anonymous Coward on Friday January 25 2019, @05:31AM (2 children)

    by Anonymous Coward on Friday January 25 2019, @05:31AM (#791625)

    I remember when programmers wrote their own functions, their own routines, their own libraries. A library was just a convenient mechanism for managing a group of related functions. There were external libraries but they rarely changed and were well documented and eventually formed the core of standards like POSIX.

    Libraries were shared by developers working on the same project but responsibility for the code being used resided with the developers - and their managers, who were older, greybeard engineers, not wanna-be MBAs, by the way.

    Everything being used was stored in source code repositories under strict version control. I've supported more different version control systems than you have fingers and toes, by the way. Really. GitHub is just the latest in a long, long line. This, too, shall pass.

    Everything was stored locally and backed up locally. We had highly available clusters, based on NFS, but everyone in the building was smart enough, back then, to know that the 'cloud' drawn on the whiteboard during meetings was imaginary.

    Machines were not accessible via the Internet but we did have modems, which were quite adequate because everything we were doing with source code editing and compilation did not involve a graphic user interface, anyway - although many of the projects being worked on, did, particularly back when X was big.

    This is what happens when you let developers do operations - so-called "DevOps" - really, an excuse for hanging two jobs onto one person, with one person's pay. Suckers!

    Real sysadmins understand dependencies. They ruthlessly eliminate offsite and remote dependencies, secure the source code to those external elements they DO depend upon, and lock everything down so it doesn't change.

    Today's corporate leaders and managers think that because they have installed Windows and maybe Linux once or twice in college, they understand systems administration, and are qualified to make critical engineering decisions related to the future of their company, IE, choosing to base the entire future of their company on AWS.

    You can't fix stupid. Against stupidity, the Gods, themselves, struggle, in vain. Etc. Talking to these folks is like talking to a brick wall. It's better use of one's time to make some popcorn and watch the slow-motion train wreck in action. You can't stop them. Don't waste your time trying. They don't want to listen.

    Those whom do not study the lessons of history are doomed to repeat them. Have fun.

    A minor tirade: as a systems administrator, I learned UNIX. Then, I learned how to rewrite sendmail configurations. Then, I learned how to automate, with shellscripts, and crontab entries. Then I learned another release of UNIX. Then I learned another vendor's UNIX. Then I learned how to compile kernels. Then I learned how to manage routing tables. Then I learned SNMP. Etc, etc, etc.

    Each one of these skills is extremely complex and extremely valuable, all on its own - even today. The proof is in how many poseurs there are out there pretending to possess or understand these skills.

    This was all decades ago, back in the 1980s, in just the first few years of my career, back when they called us "systems managers", before "information technology" existed, back when it was still MIS.

    Since then I have learned and forgotten more UNIX lore than I care to think about. I'm a walking encyclopedia.

    Then came Linux. Do you know how many Linux releases there are out there? When I was at Linuxcare, I was responsible for a library of ~150 different Linux releases. And that was ~2000!

    About the same time, Cisco came out. Then other router companies. Then firewalls. Lots of firewalls. And network monitors. And N-tier architectures, from every Internet vendor in existence. All those releases! All those manuals! All those commands!

    Do you know how many Linux and FreeBSD kernels I have customized and compiled, from source, in the past twenty years?

    And now these cheap fucks want me to learn AWS, and Python, and Google Cloud, and Ruby, and Chef ... write code all day ... AND be on call, all night ... AND manage MongoDB, along with the four or five other databases I know ... and ... and ... and ... and ... the list just keeps growing.

    Fuck these assholes. I have no use for AWS, personally. If I have to learn it on my own time, I quit.

    I think someone needs to make a statistical analysis of how many people there are in the world ... how FEW of them are interested in information technology AND actually qualified, intellectually speaking, to contribute meaningfully to the industry (as opposed to profiting from the glitz of IT and the power to deny services) ... and what the resulting odds are of a given employer locating a candidate who has all that crap on their resume AND is willing to put up with being lied to and manipulated and employed on a temporary basis, over, and over, and over, and over AND is qualified to manage their crap one-of-a-kind infrastructure built by a rapid succession of college students and contractors.

    I can actually make better money, per hour, and enjoy life much more, working outdoors, cutting and selling firewood to my neighbors, out in the country.

    ~childo

    Starting Score:    0  points
    Moderation   +2  
       Interesting=1, Informative=1, Total=2
    Extra 'Interesting' Modifier   0  

    Total Score:   2  
  • (Score: 0) by Anonymous Coward on Friday January 25 2019, @08:08AM

    by Anonymous Coward on Friday January 25 2019, @08:08AM (#791663)

    The people you describe are not stupid, they are in the business of surviving and living.
    For that purpose they make a forest of complexity around themselves.
    Meetings, coding, politics, bureaucracy is complex, because more people have reson to exist in that complexity.
    In a complex situation nobody is worthless =)

    By the way, in school it was said to me that the age of modern human begun whith the keeping of cattle.
    Cattle come in many forms, as example.
    You might think, as example, that the sweeds care for the mentally ill cuz they are nice.
    Actually, they are not, they are ceeping the mentally ill as political cattle.
    As long as they exist, and are the lowest there is, and they have sufficient living standards, nobody can come to the "somewhat" higher level little-people and take what they have with a good motivation. You have to go for the lowest first.
    And so, it is good to keep a good stock of the lowest breeds =)

    -zug

  • (Score: 0) by Anonymous Coward on Friday January 25 2019, @09:42AM

    by Anonymous Coward on Friday January 25 2019, @09:42AM (#791677)

    Best of luck with the lumberjack gig.