alt Hacker News>Avoiding 3rd party libraries seems like a false sense of security.
What a bullshit.
It's different scenario, different trade offs.
You mitigate risk of library being sold to malicious 3rd party, you avoid risk of your supply chain being hacked, you avoid API/behaviour breaks, etc.
The trade off is that you have to maintain it.
That's why dotnet's ecosystem is so loved due to MS providing 90% of needed libraries, so you avoid some 3rd parties maintained by single person.
Replies
BatteryMountain • today at 9:58 AM
Same approach here.
And since we now have coding assistants, maintaining in-house costs near nothing now. Nobody else can break us, only ourselves.
This is the way! What also affects the decision is what the code will be doing, and how much extra functionality that you will never use (extra attack surface) you will get by importing external library after library.
Often it can be a very good choice to write the functionality yourself and not rely on external libraries.