In code space, no one can hear you scream.
Staring into the void* ptr = NULL;
.NET dev
AI and maths nerd
Bitcoin enthusiast
Crusader against fake agile
Everything is trade-offs.
I'm reacting a little bit to the docker container and npm worlds I've been exposed to recently, where typically an app has many hundreds or thousands of dependencies in the stack, with new high CVEs somewhere almost every day. Many of which aren't updated for months.
It's not about eliminating all dependencies, it's more about curating them and trying to keep them tight and focused. Break large packages into smaller more focused functionality. For the cryptography - one option might be an injected abstraction, that would allow you to choose and maintain the implementation yourself.
My main objection is just out of control aggregation, and wild dependency trees with scores of packages for edge cases most people will never use.