<story><title>Surviving Software Dependencies</title><url>https://queue.acm.org/detail.cfm?id=3344149</url></story><parent_chain></parent_chain><comment><author>wwarner</author><text>Good read, I like that he expanded on the assumptions we make when we include a dependency. However, I think his treatment of dependency upgrades is a bit confused. Of course Equifax should have upgraded their struts dependency, but that is not the result of relying on software reuse, as security vulnerabilities are found in all code. If they had built their own framework, the team that produced it could just as easily published a security patch that was ignored.  
So to me the point is that important upgrades, whether proprietary or FOSS, should be made as backwardly compatible as possible. Fortunately, they usually are.&lt;p&gt;A related issue that wasn&amp;#x27;t mentioned in the article is the problem of forced upgrades. Dependencies can arbitrarily introduce incompatibilities that don&amp;#x27;t align with your own priorities, so that you end up spending a lot of time keeping current with package releases that your users really  don&amp;#x27;t care about. Publicly facing services with a broad attack surface should choose their dependencies carefully, as they&amp;#x27;ll be forced to upgrade often. Services behind a secure firewall are less urgent.</text></comment>
<story><title>Surviving Software Dependencies</title><url>https://queue.acm.org/detail.cfm?id=3344149</url></story><parent_chain></parent_chain><comment><author>austincheney</author><text>I just spent two weeks trying to figure out code at work that required 8 dev dependencies from npm locked down to certain version numbers not specified in the package.json.&lt;p&gt;That ends up being hundreds of total dependencies to run two build steps and 1 http service. What a waste of time and code.&lt;p&gt;How did we get so drug addicted to shitty outside code? Had I not been completely new to the team I could written a better solution in about an hour directly with Node.</text></comment>