Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).
If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!
I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.
Feeling pretty swell about this mentality with all the supply chain attacks happening.
@zeeg Pretty much anything that was great for humans is better for agents -- Small pull requests, feature flags, good tests, separation of concerns, linters, docs, etc.
This is crazy. The hacker installed a dead-man's switch that will wipe your computer if you revoke the GitHub token they stole from you. Revoking the token is what triggers the wipe.
@Jordy_vD_ I've thought that my entire career.
But I wanted to "move fast" on my side project so I went with Django and used the ORM.
Now I'm finding surprise N+1 queries that were easy to introduce through the ORM but never would've happened if I wrote the query myself.
Good companies don't hand their hardest, most critical projects to engineers that just walked in the door with a history of leaving early
If you want to solve those problems (and add them to your resume), you've got to stick around and earn it
@octal I think I would avoid it just because there is always potential for accidental personal purchases on a corp card.
I wouldn't want to accidentally leak private purchases just because a card was wrongfully marked as default somewhere
@Shpigford I've needed good OCR on PDFs and images so many times. I prefer storing everything in google drive but it doesn't do a great job of that.
I agree that something like good search + AI Integration on top of a "drive" (dropbox/google drive) would be perfect.
@glcst@OhNoNima People who say “train me” have no curiosity. No drive.
OSS made my career and I hate seeing engineers not take advantage of such an easy way to build credibility