Re:Rewriting Sysctl(8) in Rust: Systeroid
by jrockway on Tuesday April 19, 2022 @01:33PM
(#31086188)
I mean, the number of dependencies a node project uses doesn't really affect me. If they have 1 or if they have 1 million, it's the same "npm install" command.
I personally like to keep third-party dependencies as minimal as possible, mostly to avoid getting 8 emails a day from dependabot telling me that a dependency of a dependency of a dependency has a regex denial of service attack and some dependency in the middle has a massive breaking change that prevents another dependency from being upgraded to include the fix. (Nevermind that I'm using it on the frontend, so if a user picks a bad regex they will slow down their own browser and nobody else's.)
I personally like to keep third-party dependencies as minimal as possible, mostly to avoid getting 8 emails a day from dependabot telling me that a dependency of a dependency of a dependency has a regex denial of service attack and some dependency in the middle has a massive breaking change that prevents another dependency from being upgraded to include the fix. (Nevermind that I'm using it on the frontend, so if a user picks a bad regex they will slow down their own browser and nobody else's.)