Never run npm audit. You won’t like what you see.
If they wanted me to use a specific tool or lack thereof they should have said that. Instead they said “fix this problem” and instead of writing the entire codebase from the ground up I used the tools that were available to me so I could focus on fixing the problem instead of fixing the fix to fix the fix for the fix of the problem.
I can’t relate to this feeling at all, writing code using a library I’ve found is almost always the source of bugs. Miscommunication between the library developer and their documentation, or my ability to read the documentation. And that’s on top of how many big libraries I’ve seen with extremely simple exploits. Sadly I have to use a few, but I wince every time I install a package.
I am NOT writing a database connector unless you add an additional three months to your projects expectations.
I am NOT writing an LDAP connector.
I am NOT writing code to execute shell processes safely.
And I’m sure as hell not writing an XML parser just so I can say I did it without libraries.
JS devs that import libraries for every stupid thing (lpad comes to mind) are bad programmers, but libraries are useful and have their place.
And if my boss doesn’t want me using those libraries, they need to specify that in advance or there needs to be a company policy to that effect. Otherwise, I’m solving the problem my way since that’s what I’m getting paid to do.
Yeah I absolutely agree, my issue is with libraries that do trivial or not particularly useful things.
TFW you want to do things good, slow and expensive, but management makes you do them fast, cheap and crap.
For your entire career.
Please kill me
TFW you want to do things good, slow and expensive, but management makes you do them fast, cheap and crap.
For your entire career.
Please kill me
i got the sense that some people wanted to when i made this same point about this industry in this same community about a week or so ago.
i love the duality of lemmy sometimes. lol
Change management! :-)
Or, if possible, change employer.
(And I know we’re in meme-land, but I always see it as a developer’s task to inform of the trade-off between fast and good)
Every other skilled trade just says “Fast, Right, or Cheap: pick two.”
It’s not my fault if they always pick fast and cheap
Okay, sure, do fast. Then:
- I’ll add a refactor task to the backlog filed under “tech debt”
- please confirm again that you know we are still behind on security updates and that you’re ok with it because you are responsible for how I spend my hours
- I’d like more time to spend on bugs before we lose customers.
- Also I won’t touch that buggy part without taking the time for a rewrite because we did it “fast” per your request and it’s so hard to maintain now that it becomes a time sink on every minor change
- I know we are under time pressure right now, but as a stakeholder I request we plan a few sprints for improving reliability of our product
- It’s not “fun” to work on our code. We might lose developers if we do not address this. We both know the good coders will have no problem finding a new job and you’ll end up with the bad ones.
- Either that, or plan for loss of personnel and the extra time we need for the hiring process and the loss of developer hours
I absolutely cannot relate to using a ton of libraries in production code.
Node, and you’d be surprised.
I’ve written Node code, I just try to limit the number of libraries I use
It’s funny because it’s true. All those little guys will fuck you over eventually and likely are real trojans.
And each in their own way. Like leftpad or openssl
