Why Bloat Is Still Software’s Biggest Vulnerability

[deadalnix]

On Monday, 12 February 2024 at 17:30:23 UTC, H. S. Teoh wrote:
> All this not even to mention the insanity that sometimes 
> specifying just *one* dependency will pull in tens or even 
> hundreds of recursive dependencies. A hello world program 
> depends on a standard I/O package, which in turn depends on a 
> date-formatting package, which in turn depends on the locales 
> package, which in turn depends on the internet timeserver 
> client package, which depends on the crytography package, ad 
> nauseaum.  And so it takes a totally insane amount of packages 
> just to print Hello World on the screen.
>

"Funny" example of that.

I wanted to learn of to do a react project from scratch. Not 
using a framework or anything, just pieces the stuff together to 
make it work myself.

So babel, webpack, react, jest for testing and stylex for CSS. 
That's it. Arguably a lot by some standard, but by no means 
something wild, the JS equivalent of a build system and a test 
framework.

The project currently has 1103 dependencies. Voila. Pure madness.