I feel we started talking past each other so let’s try and nail some misconceptions about what I said.
Some people were convinced programming was “a solved problem” back in the 1960s. It’s unrealistic to say that nothing major will ever change. Experts, too, make mistakes – all the time.
That’s the ideal theory. And it’s a discussion similar to that of FP vs everything else: “Why do you need immutable state? Mutable state is fine, you need to thoroughly understand your application’s state!”. Point is, tooling should reduce the cognitive load on the programmer. We are human and can’t keep everything in our heads. That’s why we have these machines in the first place, no?
Additionally, almost nobody that I’ve ever met in the commercial programming actually understands security (me included). That’s why there are experts that craft those libraries / frameworks for us.
That’s a pretty random assumption.
…Which changes nothing, because your generated code resides inside your project and won’t be automatically changed.
Again, an assumption. Many programmers are quite busy and they’ll completely miss that. Most of the commercial programmers have their time mercilessly sliced into sprints and tasks and stories. You think the average project manager will ever tell you “OK, use all of today to upgrade libraries and edit files in our project accordingly so we are on top of our dependencies”?. For 18.5 years of career I’ve met two such people. How many did you meet? Is your current workplace allowing you that?
“Hopefully” being the key word here. Unless you subscribe to the GitHub releases of a project – which many programmers never do! – then you’ll miss it.
I do mix deps.update 1-2 times a month exactly for such reasons. People fix bugs in their open-source projects all the time. They also do performance improvements, change code to adhere to best practices (especially in the security area!) etc. It’s very sensible to periodically update your dependencies. Bonus points for reading release notes as well.
Just asserting “you have to forcibly study your generated code and manually update it periodically” is not productive. And it’s definitely something that most project managers will frown at. “Wasn’t that thing working? Yeah? Why touch it, we have a backlog of 50 issues back here!”
I feel that having a library that I only update through mix deps.update, recompile, and I am then safe against an obscure credentials hijack exploit is the better option versus updating the library and re-generating the code – which will result in two slightly different generated codes, and you’ll have to go clean after the generator, and you might make a mistake in the process.
Not sure how the latter option sounds more appealing to you, will you explain it to me?
