vibe code all the dependencies to avoid license infection
post
Took me a bit. I was staring at it for a while thinking 'What part of this is socially awkward?'
Or just copy paste the file with your utility code from project to project, with no way of tracking it. Spending time trying to find the most up-to-date copy is just part of the fun!
"A little copying is better than a little dependency."
Judgement call. When it's something prone to change that's hard to get right, duplicating it just creates more maintenance burden.
For sure. But I've seen a lot more sins committed in the name of reusing code than in the name of minimizing dependencies.
Plus, it's bloat. A snippet of extra code isn't going to cause much trouble, but then you end up doing it a lot, and there's snippets in the snippets, and all the sudden something that used to fit on a floppy is 3 gigs.
I have no idea how much of a factor this is relative other various performance-sacrificing shortcuts, but Wirth's law is a thing.
When I do a security audit on apps with hundreds of dependencies, I die a little bit
Another level of this dilemma:
- Pin all dependency versions – Prevents receiving security patches
- Don’t pin dependency versions – Enables supply chain attacks (see https://nesbitt.io/2026/02/03/incident-report-cve-2024-yikes.html)
Reuse is only good in the context of 90s era OO programming wisdom of "Coupling is bad, cohesion is good".
all 10 comments