For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond what already comes with Python. I like the peace of mind that comes from not having to worry about a hidden tree of dependencies that could easily some day harbor a Trojan horse.
This is good wisdom, and I think this is a strong reason why language and runtime developers should ensure their standard library is (over)complete.
Go does this well, to the point where a lot of people in the community say "you don't need a library" for most use cases, only for e.g. database drivers. This is contrary to what a lot of developers believe, that they need e.g. a REST API library or enterprise application framework as soon as possible.
Is this a win for .NET where the mothership provides almost all what you need?
I generally limit myself to what's available in my distribution, if the standard library doesn't provide it. But normally I never use requests because it's not worth it I think to have an extra dependency.
But then you rely on Python, C, your editor with all its extensions etc.
I develop as a pure amateur and there are areas I would never get into without libraries.
First are dates, it is a world of pain. Arrow is the answer (in Python)
Then HTML, another world of pain perfectly described in a Stack Overflow answer. Beautifulsoup.
HTTP is arguably easier but requests! :)
At some point there is a risk assessment to do and one should make decisions based on that. Kudos for having gone that way yourself!
> I go out of my way to avoid using external packages.
I go out of my way to avoid Javascript. Because in all my years of writing software, it has 100% of the time been the root cause for vulnerabilities. These days I just use LiveView.
I always force myself to do this too. The only 3rd party python library I regularly use is "requests" basically —a dependency that comes with its own baggage, see the recent controversy about "chardet"— but I go out of my way to grab it from pip instead installing it via pip. :-)
Something like this: