VMG

> just in your own code that is less well audited than public libraries

why do you think public libraries, which change all the time, get deprecated, handed off and supply-chain attacked are well-audited in any way?

No. I'm done with npm-style dependency sprawl and the supply chain nightmares. Done with plugins, extensions, marketplaces with "install at your own risk" disclaimers.

Give me a opinionated monolith by somebody who has something at stake and doesn't externalize these costs, i.e. a corporation.

Maybe once we live in a world with lean-verified wasm-sandboxed provable-secure software we can get back to installing software written by randos on the internet.

> “What we think” and “Ideal”

> In 2011, Michael Norton and Dan Ariely asked more than 5,000 Americans how they thought wealth was split between the five fifths of households, and how they would ideally split it. The Companion spreads those five shares across all 100 percentiles of the 2026 wealth total in a smooth curve (Appendix 3). Many different curves fit five numbers, so these two shapes are only illustrations. The actual bars come from percentile-level data. These two curves do not.

...... or do you???

Plus you get a bonus random line "methods are all on the top" in the commit message that makes no sense to anybody.

And if your muscle memory doesn't allow an immediate transition, give yourself 2 weeks. That's how long it took for me at least.

Invest in custom tooling and helper scripts.

for all intents an purposes, the paper as well as the lean repo could be full LLM output with zero human involvement

I looks like we are breezing past the point where unassisted humans can understand any of this

I hope it's not too close to my solar system!

I assume one can't benchmaxx multi-year long efforts, clean architecture, taste etc as easily as these "make tests pass" tasks

A type like NonEmptyString is a weak defense against that, as a lazy dev can just pass a single space character or something similar.

Usually, you run the actual packaged dependency code at some point anyway, and usually with the same permissions as the install process.

So all of these setup scripts (good or bad) can just move their entrypoint from npm to wherever the `import` or `require` happens.

It seems to me that this is a small stumbling block at best, unless the whole ecosystem moves to a deno-like sandboxed environment. Maybe that is the plan?