I still find it mind boggling that businesses have build processes for their core properties that rely on pulling hugs swathes off third party code in from the internet. How can that ever possibly be secure and robust?

Had they written all the dependencies themselves, would they have been as secure and robust?

The tradeoff isn't simple, and will be different for each company. I think everyone can point at a couple of components that are complex and massively benefit from the work poured into them and the large install base finding all the edge cases. Equally everyone can name a couple of dependencies that anyone could rewrite in a couple hours, and maybe even improve on the way.

Maybe, maybe not, but they certainly wouldn’t have included as many widespread, well known vulnerabilities with exploits already in the wild. And even if the imported code was perfect at the time it was imported, pulling in changes automatically is still an attack vector that you could drive a fleet of buses through.

Note that I’m not saying “never use libraries”, which your points seem mainly aimed at. Code reuse is great! I’m just not sold on automatic, unmonitored updates to libraries.

It’s even scarier when you actually sit down and review some of the code you’ve been importing for years…

It has resulted in a major thinking shift for me. Mostly initiated by a malicious nodejs package being quietly pulled in.

Is there a language ecosystem you prefer now?

I mostly write stuff in Go with no imports at all now. It’s just that and stock vim on macOS is my entire stack.

I am fortunate that my own contributions only require that.

Same with C++. Dependencies were boost, qt, gtk, and a few others and that was pretty much it. Since vcpkg, cmake, conan, and a few others, the C++ "ecosystem" has started growing far more in the last 10 years, than in the previous 20.

Is the modern tooling to blame for? It didn't use to be so simple that everything could be automatically updated or pulled. Had to actually go out and see what you were brining in and maybe even take a look in documentation or dates of last update.

I don't think there's one real reason but a combination, but I can list the features that C# and Java ecosystems had since the early 00s, and javascript/Rust have since they came around, but C++ hasn't had until recently.

1. one or more major package hubs

2. one package manager, or at least, a package standard

3. easy to consume/build (source code to binary)

4. easy to publish

5. easy to download (one liner in your build script, e.g. package.json, vcproj, cargo.toml, build.gradle etc.)

At the moment C++ only really has 5. - easy to download: cmake, conan, vcpkg, build2, can all download easily.

1-4 are a work in progress for C++, but are far better than 10 years ago.

Looking at https://wiki.alopex.li/LetsBeRealAboutDependencies

Perhaps the reason is package managers for C are called distro maintainers (for Linux/BSD)