Library dependency
lastmod 2025-11-24created 2025-07-202 edits
Library dependency
a relationship described in and managed by a software dependency manager tool to mitigate dependency hell
NIH (Not Invented Here) is far cheaper than the wrong dependency
- NIH (Not Invented Here) is far cheaper than the wrong dependency | GeekNews
- [Original] NIH Is Far Cheaper Than The Wrong Dependency
Dependencies look like free features, but in reality they come with various costs and complexity
- The wrong dependency brings various risks, such as a learning curve, sudden interface changes, and distribution and installation problems
- As a notable example, TigerBeetle pursues a "zero dependency" policy for security, performance, and operational simplicity
- The author proposes a framework for evaluating dependencies (ubiquity, stability, depth, usability, completeness)
- Critical thinking to tell good dependencies from bad ones is essential, as is careful judgment when choosing a dependency that weighs total cost and risk, not just short-term productivity
Examples of good dependencies
- POSIX system calls
- Ubiquity: available on almost every platform, including Linux, Android, macOS, and BSD
- Stability: very high interface compatibility with almost no changes
- Depth: a single API hides hundreds of thousands of lines of kernel code
- Usability: a somewhat traditional C style, but no great difficulty in use
- Completeness: mostly fine, but there are detailed issues such as data persistence on storage devices
- Ubiquity: supported by most terminals except Windows' cmd.exe
- Stability: unchanged since 1991
- Depth: creating your own standard would be absurdly hard
- Usability: fine apart from the obscurity caused by the Esc character
- Completeness: very little to worry about regarding hardware dependencies
- Ubiquity: web browsers are installed in almost every environment worldwide
- Stability: a strong backward compatibility policy
- Depth: so deep that building your own browser is practically impossible
- Usability: somewhat complex, but excellent documentation and developer tools
- Completeness: very complete, except for special cases such as files, audio, and video
Dependency cooldown
A dependency cooldown is a simple and effective security technique that can mitigate most open-source supply chain attacks
- Attackers usually hijack popular open-source projects to distribute malware, but most attacks have a short exposure window of a week or less
- Setting a cooldown that waits a certain period (e.g. 7 days) after a new version is released greatly reduces the risk of infection through automatic updates
- Dependabot, Renovate, pnpm, and others already support cooldowns natively, which are easy to configure and cost nothing extra
- Providing cooldowns by default at the package manager level could help strengthen supply chain security and reduce unnecessary alerts