Show HN: Zero-dependency Java framework out of beta

Re:Show HN: Zero-dependency Java framework out of beta by schemescape on Monday September 25, 2023 @06:13PM (#37651441)

I'm reading it as "minimal in scope". Scope creep tends to be a given for established/battle-tested libraries, and I'd argue that over time scope creep could counteract security benefits of being battle-tested.

Note that I'm not basing this on data, just on my intuition that a lot of major security bugs seem to be related to obscure/infrequently used functionality.

[ Parent | on HN ]

Re:Show HN: Zero-dependency Java framework out of beta by frant-hartm on Tuesday September 26, 2023 @03:00AM (#37655468)

This is definitely true. The more complex the library is, the more chance for a vulnerability to happen. And combining 2 independent low level vulnerabilities may end up being a critical vulnerability.

The same may happen in your project, but if you use simple(r) dependencies, it's less likely.

[ Parent | on HN ]