rockerest’s avatarrockerest’s Twitter Archive—№ 18,379

      1. 3 things about this: 1) gross. Aaron Swartz was trying to liberate knowledge. 2) if you, a consumer got hit by this, you STILL haven't learned the save-exact=true lesson. Your dependencies are YOUR SOFTWARE. 3) library authore: not pinning your deps is wildly unprofessional. marak/1479200803948830724
    1. …in reply to @rockerest
      Software devs seemingly can't be taught lessons, but here is the one that KEEPS coming up. You pin your dependencies to a NUMBER. Not a range. Not a major. A single number. Then your process gets a copy of that dependency, and packs it up for the web.
  1. …in reply to @rockerest
    Then - and I cannot stress this enough - YOU NEVER TOUCH THAT FILE AGAIN, until you have gotten a new version and tested it. Downloading your dependencies from the internet every time you build is absolute bush league behavior and you should not be allowed near build systems.
    1. …in reply to @rockerest
      esinstall can do this quite simply, but I prefer a very simple local script that generates the web-friendly files, since esinstall has some goofy limitations and edge cases.
      1. …in reply to @rockerest
        One of the nice things about this is that if your pinned version of some library doesn't change, you won't consume upstream dependency changes either, because you're not depending on that library's amateur-hour dependency problems, either.
        1. …in reply to @rockerest
          Anyway tl;dr: I don't feel bad for any of you. You want to be called a professional software engineer? Then be professional, and do the engineering work.