Our Software Dependency Problem
This paper lends significant legitimacy to a casual observation that I&#x27;ve been concerned about for a long time: as the standard for what deserves to be a module gets ever-lowered, the law of diminishing returns kicks in really hard.<p>The package managers for Ruby, C#, Perl, Python etc offer ~100k modules. This offers strong evidence that most developer ecosystems produce (and occasionally maintain) a predictable number of useful Things. If npm has 750k+ modules available, that suggests that the standard for what constitutes a valuable quantity of functionality is 7.5X lower in the JS community. Given that every dependency increases your potential for multi-dimensional technical risk, this seems like it should be cause for reflection. It&#x27;s not an abstract risk, either... as anyone who used left-pad circa 2016 can attest.<p>When I create a new Rails 5.2 app, the dependency tree is 70 gems and most of them are stable to mature. When I create-react-app and see that there&#x27;s 1014 items in node_modules, I have no idea what most of them actually do. And let&#x27;s not forget: that&#x27;s just the View layer of your fancy JS app.