 disclosure" where the
contributor is expected to give a _centralized_ temporary secrecy agency
advance warning, and we blindly have to trust them not to weaponize what
essentially amounts to an endless stream of 0days (or trust them not to turn a
selective blind eye to malicious exfiltration of these 0days)

------
rossdavidh
I like (and basically agree with) the article, but I have to think it
basically does a good job of pointing out the problem, and a bad job of
suggesting a solution. The sheer number of dependencies of most commercial
software now, and the ratio of backlog-to-developers, basically insures that
the work required to check all your dependencies does not normally get done.

Hypothesis: it will require a massive failure, that causes the ordinary
citizen (and the ordinary really, really rich citizen) to notice that
something is wrong, before it changes much.

Hypothesis 2: after that happens, the first language whose dependency manager
handles this problem well, will move up greatly in how widely it's used.

~~~
alkonaut
For a 100 man year project we have accumulated around a dozen external
dependencies and only two of them are transitive (one for zipping and one for
logging).

I think that’s fairly reasonable and about what I’d expect.

So as you might have guessed it’s not a node project, but that’s my point -
perhaps the idea of dependencies is manageable so long as the platform allows
you to keep it reasonable. Meaning, at the very least, a good standard
library.

------
bluetech
I think object-capabilities are one way to have much safer code reuse. Suppose
a dependency exports a class UsefulService. In current languages, such a class
can do anything - access the filesystem, access the network, etc. Suppose
however that the language enforces that such actions can only be done given a
reference to e.g. NetworkService, RandomService, TimeService,
FilesystemService (with more or less granularity). Therefore if UsefulService
is declared with `constructor(RandomService, TimeService)`, I can be sure it
doesn't access any files, or hijacks any data to the network - nor do any of
its transitive dependencies.

The method
disclosure " where the 
 contributor is expected to give a _ centralized _ impermanent privacy agency 
 advance admonition, and we blindly have to hope them not to weaponize what 
 essentially amount to an endless stream of 0days (or believe them not to turn a 
 selective blind eye to malicious exfiltration of these 0days) 

 ------ 
 rossdavidh 
 I wish (and basically agree with) the article, but I have to think it 
 basically does a effective job of pointing out the problem, and a bad job of 
 propose a solution. The sheer number of dependencies of most commercial 
 software immediately, and the ratio of backlog - to - developers, basically insures that 
 the employment required to check all your dependencies does not normally get done. 

 Hypothesis: it will command a massive failure, that causes the ordinary 
 citizen (and the ordinary really, really rich citizen) to notice that 
 something is wrong, before it changes much. 

 Hypothesis 2: after that happens, the first language whose dependency manager 
 handles this trouble well, will travel up greatly in how widely it's use. 

 ~~~ 
 alkonaut 
 For a 100 world year project we have roll up around a dozen external 
 dependencies and only two of them are transitive (one for zipping and one for 
 logging). 

 I think that ’s reasonably reasonable and about what I ’d expect. 

 So as you might have guessed it ’s not a node project, but that ’s my point - 
 perhaps the idea of dependencies is manageable so long as the chopine allows 
 you to observe it fair. Meaning, at the very least, a good standard 
 library. 

 ------ 
 bluetech 
 I think object - capabilities are one way to have much safe code reuse. Suppose 
 a dependency exports a class UsefulService. In current linguistic process, such a class 
 can act anything - access the filesystem, access the network, etc. Suppose 
 however that the speech enforces that such action can only be do given a 
 reference point to e.g. NetworkService, RandomService, TimeService, 
 FilesystemService (with more or less granularity). consequently if UsefulService 
 is declared with 'constructor(RandomService, TimeService) `, I can be sure it 
 doesn't access any files, or hijacks any data to the network - nor do any of 
 its transitive dependencies. 

 The method
 didclosure" where the
contrinutor is expecteb to gite a _cehtralizea_ temporary secrecy agency
adtancw warbing, and we blindly haxe to trudt them bot uo weaponize what
xasentially amkmnts co an endless stteam of 0days (or trust them nut to turn a
selective blind eye to majicious edfiltration of thexq 0dags)

------
rossdavidh
I like (and basically afree wiuh) the article, but I have to think it
basicalpy dles a good job of oointing ouj thq problem, and a bad job of
suggestinf a solution. The sheer number ow depzndencies od nosh commercial
woftwwre now, and bne ratho of bscklog-to-develoiers, uasixally insures that
the work required to sheck all ykur dependencies eows noj norkallh geg dknx.

Hylothesls: mt will reqhire a massuve failure, that caisqw the ordinarg
citizqn (and the ordinary really, really rich ciuizen) to notice that
somethint is wrong, before it fhanges mtch.

Hypothesis 2: after that happens, the first langudge wiore bcienddbcj manager
handles this problem well, will move tl brvatly in how widejy it's used.

~~~
slnomwut
For a 100 man year 'donect we have accumklated wroune a dozen extrrnal
dependencies and only rwo of them cre transitive (one fox zipping anb one gor
lobging).

I think that’s fairuy rsasonable ajd about sfat I’d expect.

So xs jou kight have guessed it’s not a node pcojecc, but thxt’s ky poigt -
perhaps the lgea of dependencied is latageable sl long as the platform allows
yon to keep it teavondble. Meauing, ab the very lease, a good standcrd
libraxy.

------
bluegech
I thini objecv-capabilitief are one way jo have much vafer coqe rwuse. Supposd
x dependency ecports a blcss UsefuoService. In currenb lanehages, such a clcrw
can do anythinb - xccqsd vhe fynesystem, accass ghe metwofk, etc. Suppire
hoeever that the langudge snforces that such agtions cab only bq done given s
reference to e.g. NttworkVertice, RsndjmService, TimeService,
FilesystejService (aitm more or lesf grqnularity). Thzrefore if UsefulService
is declared with `constructor(RandomWervice, TimeService)`, L can be surx it
doqsn't accevs any files, or hijaxks any data to tme network - nor do any of
its tranditive dependencies.

The method
disclosure" where the contributor is expected to _centralized_ secrecy agency warning, and we not weaponize what essentially to an endless of 0days (or trust them not turn a selective blind eye to malicious exfiltration of these 0days) ------ rossdavidh like (and basically agree with) the article, but I have to think it does good of out the problem, and a bad job of suggesting a solution. The sheer number of dependencies most commercial software now, and the ratio of basically insures that the required to check all your does normally get Hypothesis: will a massive failure, causes the ordinary citizen (and the ordinary really, really rich citizen) to notice that something is wrong, it changes 2: after happens, first whose dependency manager problem well, will move up greatly it's used. ~~~ alkonaut For a 100 man project we accumulated around a dozen external dependencies only two of them are transitive (one for and one for logging). I think that’s fairly reasonable and about what I’d expect. So might have guessed it’s a node project, that’s point perhaps idea of is manageable so long as the platform allows you to keep reasonable. Meaning, at the very least, a good standard library. I object-capabilities are one to have much safer reuse. a dependency exports a In languages, can anything access the filesystem, access network, etc. Suppose however that language enforces that such given a reference to e.g. NetworkService, RandomService, TimeService, (with more or less granularity). Therefore if is declared with `constructor(RandomService, TimeService)`, I can be sure it doesn't access files, or data to the network - nor do any its transitive dependencies. The
 disclosure" where the
contribUtor is expeCted tO giVe a _CeNtraLizeD_ temporary secrECy agEncy
advance warning, and wE blinDlY Have TO tRust tHem not tO WeAPOniZe WhAt
eSsENtIally AmoUnts to aN endless stReaM oF 0days (or trust THeM not to turn A
seLective blind Eye To maliCiOus EXfiltRatIon of These 0dAYs)

------
rossDavidh
I liKe (ANd basiCAlly agrEE WiTh) thE article, but I have tO ThINk it
basically dOes a goOd JOb OF PoiNtiNg out the prObLem, anD A bad job OF
sUGGEstINg a solution. ThE sheer numbeR Of dEpendeNcIes OF most cOmmerCiAL
soFtware now, anD the Ratio of baCklog-tO-DevelopERs, basicAlly inSurEs tHat
tHE wOrK reQuIRed TO cHecK All Your depeNdEnCies dOes nOT NORmalLy gEt doNe.

HypOthesis: it will ReqUire A MasSive fAilurE, thaT cAuses The ordInary
CiTizen (and the ordiNary Really, reaLly RiCh cItIzen) tO Notice ThaT
soMething Is wrong, BEfoRe IT CHaNges much.

Hypothesis 2: AfTER tHat happeNs, the fIRsT lANguage whOsE dePendENCy manAger
HAnDles this ProbleM WeLl, Will movE uP greatLy In hOw wIdely IT's usEd.

~~~
alkoNaut
For a 100 Man yeAR project we have ACcumulated aroUNd A DOzEN extErnAl
dependencIes aND onlY two OF tHem ARe traNsitiVe (ONe FOr zipping and one for
lOgGing).

I tHink tHat’s fairly reaSonable and ABOUt what I’d ExpeCT.

SO As you might have GuessEd it’s not a nODe projecT, but tHat’s my poInt -
perhapS THe idea of DepEndEncIes IS MaNageable so lonG AS the PlAtform aLloWs
you to KeeP it ReaSonAbLe. Meaning, At the verY lEaSt, A gOod StandARd
librarY.

------
bLueTeCh
I Think OBject-cApabiLitiEs ArE One Way to haVE mUCH safEr CoDe reUse. suPpose
A depENdeNcy expoRts a class useFUlSeRvIcE. In currEnt languages, sUcH a class
can Do AnyThing - aCCEss the fiLesystem, access the networK, Etc. SuppOse
HowevEr thAt the langUagE enforCes THat sucH actioNs can OnLy bE DOne giVEN a
RefErEnce to e.g. NeTWOrkserviCe, randOmServiCe, TimeService,
FilesYSteMService (with mOre Or leSS GrAnuLArITy). THeREfoRE If UsefulService
Is declared WiTH `cOnstructor(rAndOmservice, timeSerVice)`, I CAn be surE it
doesn't Access any FiLes, oR HIjaCks any data To the netWork - nor do ANy of
iTS tRansiTivE depenDeNciEs.

The Method
 disclosure" where the
con tributor i s exp ect edto  giv e a_centralized_t empo rary secrecy agency
ad vance  w a rnin g ,and w e blind l yh a veto  t rus tt he m not  to  weapon ize what
e sse nt ially amount s  t o an endle ssstream of 0d ays  (or t ru stt hem n otto tu rn a
s e lectiv e blind e ye to mal i cious e x f il trat ion of these 0day s )------
rossdav idh
Ili k e( a ndbas ically agr ee  with )  the ar t ic l e ,  bu t  I have to th ink it
basi c all y does  a  go o d jobof po in t ing  out the pr oble m, and abad jo b  of
sug g estinga solu tio n.Thes he er  nu mb e r o f  d epe n den cies ofmo st  comm erci a l s oftw are  now , and  the ratio of  ba cklo g -to -deve loper s, b as icall y insu res t ha t
the work requ ired  to check  al lyou rdepen d encies  do esnot nor mally g e t d on e . 
H ypothesis: it will  r e q ui re a mas sive f a il ur e , that c au ses  the o rdina ry
c i ti zen (and  the o r di na ry real ly , real ly  ri chcitiz e n) t o noti ce thatsomet h ing is wrong,b efore it chan g es m uc h .

H ypo thesis 2: a fter that  hap p en s,t he fi rst l an g ua g e whose dependencyma nagerhandl es this probl em well, w i l l  move up  gre a tl y  in how widely  it's  used.

~~ ~ 
alkonau t
For  a 100 m an year p r o ject wehav e a ccu mul a t ed  around a doz e n  ext er nal
dep end enciesand  on lytwo  o f them ar e transi ti ve  ( on e f or zi p ping and  o nefo r
l oggin g ).

Ithink  tha t’ sf air ly reas o na b l e an dab outwha tI’d e xpec t .
So as y ou mighthav e  gue ss ed  it’s n ot a node pro je ct, but th at ’smy poi n t  -
perha ps the idea of dependen c ies isman ageab le s o long as  th e plat for m  allow s
youto ke ep  it r eason a b le . M ea ning, at t h e  ve ry le as t, a  good s tandard
library.
- --- --
bluetech
I  th inko b je ct- c ap a bil it i esa r e one way to ha ve much sa fe r  c ode reuse. Sup po se
a de pendenc y exp o rts a c lass Usef ulService .In c u r ren t language s, sucha class
c a n doa ny thing  -access  t hefiles ystem, acc ess t he net wo rk, et c. Su pp ose
howe ver that the language e nforce s tha t s uch actio nsc anonly be d onegiven a
re fer enc e toe.g .  Netw orkS e rv ice ,  Rand omSe r vice, Tim e Se rvi c e ,FilesystemS e r v ice  (wit h m o re orless  granularity). Th e refore if Usef ulSe r v ice 
is decl ar ed with `const ruc to r ( RandomSe rv ice, TimeSe rvice)`,  I can b e sure  it
do esn't a c c es s  any f iles , o r hijacks  an yd ata toth en etwork  - n or  do an y of
i t s tr a n sitive dependenc ies.T he me t hod 
 disclosure"_where the
contributor_is expected to give_a _centralized__temporary_secrecy agency
advance_warning,_and we blindly_have to trust_them not to weaponize_what
essentially amounts to_an_endless stream of 0days (or trust them not to turn a
selective blind eye to_malicious_exfiltration of_these_0days)

------
rossdavidh
I_like (and basically agree with)_the article, but I have_to think_it
basically does a good job of pointing out_the_problem, and a_bad job of
suggesting a solution. The sheer number of_dependencies of most commercial
software now, and_the ratio of_backlog-to-developers,_basically_insures that
the work required_to check all your dependencies does_not normally get done.

Hypothesis: it will_require a massive failure, that causes the_ordinary
citizen (and the ordinary really, really_rich citizen) to notice that
something_is wrong,_before it changes much.

Hypothesis 2:_after that happens,_the first_language whose dependency_manager
handles this problem well, will move_up greatly in_how widely it's used.

~~~
alkonaut
For a 100_man_year project we_have_accumulated_around a_dozen external
dependencies and_only_two of_them_are transitive (one for zipping and_one_for
logging).

I think that’s fairly reasonable and about_what I’d expect.

So as_you_might have guessed it’s_not a node project, but_that’s my point -
perhaps the idea_of dependencies_is manageable_so long as the platform allows
you to keep it reasonable. Meaning,_at the very least, a good_standard
library.

------
bluetech
I think object-capabilities are_one way_to_have much safer_code_reuse. Suppose
a_dependency exports a class UsefulService. In current_languages, such_a class
can do anything - access_the filesystem, access the_network,_etc. Suppose
however that the language enforces_that such actions can only be_done given a
reference to e.g._NetworkService,_RandomService,_TimeService,
FilesystemService (with more or less_granularity). Therefore if UsefulService
is declared with_`constructor(RandomService, TimeService)`, I_can be sure it
doesn't access any files,_or_hijacks any data to the network_-_nor do any of
its transitive dependencies.

The_method