Yeah, pinning dependencies is very similar to vendoring or cloning them. By cloning, you get to know the code better and how it is structured, plus you cherry pick only the features you want.
But, like you said, you are at risk of introducing new vulnerabilities.
I'd just prefer making that bet on myself than someone I don't know
It makes me wonder if large engineering organizations are going to splinter. The coordination costs are getting, proportionally, much larger than they used to.
When I left my corporate engineering job wayyyyy back in March, there were engineers and engineering leaders going off and getting a lot done, individually or in small teams. But project management and QA couldn't keep up with it. Managers resorted to turning their tokens loose on Jira just to try to make sense of it all (which, ironically made them the first to hit their token goals on the dashboard every week, and brought Jira to it's knees).
And, even worse, the junior engineers had no idea what was going on or how to get involved in anything.
I really don't like how the payment plans work with the providers right now. I feel this pressure to use all my tokens for the week, often just "wasting" them. But also, I want to take advantaged of the subsidized tokens in Claude Code and Codex for as long as I can.
There is this real danger that our thinking, and the things we make, become bloated without constraints.
IMO software has gone to shit since both mobile phones and laptops mostly have massive amounts of compute. We always seem to use it to the limit, just because it's there.
Vendor your dependencies, clone or port them where needed, and freeze them. Most good packages these days do not have a deep dependency tree, and we should stop using the ones that do.
I spent a week with claude and codex re-implementing several packages which had dependency trees deeper than I would like.
Most of these packages are trivial to clone.
"But now you're not getting the upstream fixes" they will say.
Yeah, it's appropriately ironic that these things were supposed to give power to the people (excluding the private jets), but power has become consolidated to those who have the means to consolidate it ... and the climate pays.
Additionally, a question for you: I don't have experience in finance. Do you think this idea of having a settlement period for crypto transactions could work?
The carbon emission problem with crypto currency and AI is analogous to the oil and gas industry. When you boil it down to first principles, we are extracting resources from the Earth, and destroying our climate, in the hope of some sort of economic gain.
And the economic gain is tenuous at best.
I wrote an opinion on HN about the carbon problem in crypto as well.
I'd be really curious to know if this could be use case for AI code generation tools using speech recognition. I don't know of any, but this could be very interesting.
I was part of this discussion in 2009-2012, and was curious if it was still out there. It is!
It's fascinating to take dig stuff up like this and replay it, knowing what we know now.
Of course, everyone is using the new ES modules spec now, but it's hard to imagine how we would have got there without working through the ideas which led to CommonJS.
This started before Node.js, when we were playing around with the Narwhal runtime.
One really interesting concept which never got traction was creating a standard library for JavaScript.
To really become valuable in your role you need to leverage your experience and skills to become a force multiplier (as mentioned several other places in this thread).
There is some good advice in here to help junior devs level up. But I would start by boiling it down to one that is easier to remember as you become a manager / coach:
Try to remember what worked well for you when you were learning, and then do that for your team.
I have gone back to that well over and over as I've moved between senior, principal, and management roles.
Copilot may be one of the most valuable early use cases for chat AI.
I've been brushing off AI as overhyped, but this is very compelling. I believe the real crux of software engineering is thinking about the problem and organizing solutions today which can be changed/improved/iterated in the future. Programmers too often overweight the time it takes to type things (using short variable & function names or creating terse 1 liners). But if our objective is to make code easy to change/improve/iterate in the future, then it needs to be readable now.
The nice autocomplete features in most IDEs have been a huge win to productivity along with Google search. I think chat AI could be an order of magnitude improvement.
I’ve been recreating in the mountains for a few decades now, some of it pretty serious. Honestly, nothing has taught me more respect for life than being challenged in the mountains. The lessons I’ve learned I’ve applied to software, management, and life in general. It allows you to keep a cool head when the world is on fire.
> There is a ton of practical stuff written in this general area if you search for "mind mapping" or "zettelkasten" (links below).
I think sometimes we can overweight the impact of tools and systems for retaining knowledge. These tools can be useful (I'm working on my own home grown versions of them) and I am getting better with the systems as I get more practice. But, still, this is a race you can never win. As you digest more information, you consume more.
Eventually you've got to get out there and be a maker.
But, like you said, you are at risk of introducing new vulnerabilities.
I'd just prefer making that bet on myself than someone I don't know