• Admiral Patrick@dubvee.org
    link
    fedilink
    English
    arrow-up
    10
    arrow-down
    1
    ·
    edit-2
    9 months ago

    Eh, I’d say any language that offers a package repository is just as susceptible. I’m neither pro- nor anti- dependency, but I do always try to keep them to an absolute minimum regardless of what environment I’m working in. Sometimes it makes sense to not reinvent the wheel.

    • Pennomi@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      ·
      9 months ago

      Yes, but other languages have exponentially fewer packages that install when you add something, making the attack vector smaller and easier to monitor.

      The best way to fix this is for library authors to avoid installing as many sub-dependencies as possible (is-odd, being an obvious example). But that’s a fundamental culture problem.