logoalt Hacker News

tmoertellast Monday at 8:00 PM7 repliesview on HN

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond what already comes with Python. I like the peace of mind that comes from not having to worry about a hidden tree of dependencies that could easily some day harbor a Trojan horse.

[1] https://github.com/tmoertel/tempest-personal-weather

[2] https://pypi.org/project/requests/


Replies

binaryturtleyesterday at 2:27 PM

I always force myself to do this too. The only 3rd party python library I regularly use is "requests" basically —a dependency that comes with its own baggage, see the recent controversy about "chardet"— but I go out of my way to grab it from pip instead installing it via pip. :-)

Something like this:

    try:
        import requests
    except ImportError:
        from pip._vendor import requests
Cthulhu_yesterday at 1:19 PM

This is good wisdom, and I think this is a strong reason why language and runtime developers should ensure their standard library is (over)complete.

Go does this well, to the point where a lot of people in the community say "you don't need a library" for most use cases, only for e.g. database drivers. This is contrary to what a lot of developers believe, that they need e.g. a REST API library or enterprise application framework as soon as possible.

dnnddidiejlast Monday at 10:56 PM

Is this a win for .NET where the mothership provides almost all what you need?

show 3 replies
pwillia7yesterday at 12:45 PM

and the pendulum swings again the other way...

show 1 reply
LtWorflast Monday at 8:26 PM

I generally limit myself to what's available in my distribution, if the standard library doesn't provide it. But normally I never use requests because it's not worth it I think to have an extra dependency.

show 1 reply
BrandoElFollitoyesterday at 11:40 AM

But then you rely on Python, C, your editor with all its extensions etc.

I develop as a pure amateur and there are areas I would never get into without libraries.

First are dates, it is a world of pain. Arrow is the answer (in Python)

Then HTML, another world of pain perfectly described in a Stack Overflow answer. Beautifulsoup.

HTTP is arguably easier but requests! :)

At some point there is a risk assessment to do and one should make decisions based on that. Kudos for having gone that way yourself!

neyayesterday at 2:03 AM

> I go out of my way to avoid using external packages.

I go out of my way to avoid Javascript. Because in all my years of writing software, it has 100% of the time been the root cause for vulnerabilities. These days I just use LiveView.

show 1 reply