alt Hacker News> I’d rather rely on proven libraries with well-defined abstractions than generate hundreds of lines of code which solve a local problem for me.
I 100% disagree with this. Supply chain attacks are already at an all-time high due to agentic hacking assistance, and that trend shows no sign of slowing. Every dependency you add is another potential attack vector, and just checking the dependency’s code doesn’t solve the issue - your dependencies also have dependencies!
The cost of rolling your own has gotten so low that it’s almost always a better security tradeoff to reimplement the thing yourself. Is that a good thing? I’m not sure.
Replies
What about the vulnerabilities you yourself introduce when using AI? or is the assumption that (1) there will be zero or (2) you won't ever open source so no one will know about them?
> The cost of rolling your own has gotten so low that it’s almost always a better security tradeoff to reimplement the thing yourself. Is that a good thing? I’m not sure.
Why stop there? We could eliminate all external dependencies and even build our own compiler and OS, since the cost of rolling own solution has apparently gotten so low, right? Sometimes I feel like I'm living in a completely different dimension from some of the commenters here.
If coding is anything like image generation, everybody is getting the same output anyway, which means we are back to nearly standard libraries just that are being dynamically produced. I see your claim as a new version of security through obscurity. It is way easier to patch all variants of a product when you can identify their lineage as variants in the first place.