Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by detaro on Tuesday March 02, 2021 @03:37PM
(#26320290)
if you don't write new code, you also don't pull in new dependencies, and have time start new code ;) And cost to dependencies makes you optimize what you pull in.
(Cost to dependencies doesn't have to be just review time. E.g. in my embedded software projects, the calculus for "will we need to update this" looks very differently than it would for your typical web app. And extracting interesting bits from libraries and including only that into the main project is maybe more common, reducing the surface of a dependency - which would be a bad idea if you expect frequent changes, but these projects typically don't)
(Cost to dependencies doesn't have to be just review time. E.g. in my embedded software projects, the calculus for "will we need to update this" looks very differently than it would for your typical web app. And extracting interesting bits from libraries and including only that into the main project is maybe more common, reducing the surface of a dependency - which would be a bad idea if you expect frequent changes, but these projects typically don't)