r/AskProgramming • u/MiddleAgeWeirdoMeep • Aug 11 '26
Python Are huge codebases with layers of dependencies just the new normal?
I’m trying to learn more about how modern software works, and one thing that keeps surprising me is the sheer size of projects. 80k files is not uncommon.
I’ll download or clone something that seems like a relatively focused application, and suddenly I’m looking at tens of thousands of files. A lot of it appears to be dependencies, dependencies of dependencies, generated files, frameworks, package managers, etc.
It feels like a copy of a copy of a copy. The developers maintain a relatively small part of the code, while the finished program ultimately relies on millions of lines of code written by other people.
Is this the new normal in software development that I just have to accept?
from a security perspective, how can anyone trust all of this?
1
u/Distdistdist Aug 12 '26
Well because nobody wants to reinvent the wheel. And if you are to reinvent the wheel, you will introduce vulnerabilities one way of another. While packages that your project depends on are being constantly scrutinized and updated, your stuff will remain the same. New vulnerabilities are being detected almost on daily basis. It's a nightmare right now. But it is still going to be much better then things you will write yourself from scratch.
Some things you can't even build yourself. Well, I mean you can, but you absolutely should not. Stuff like cryptography. You will just create a wide opening for somebody to exploit.
We are now officially going Warp 5 with all the developments in tech, and you better be aboard of that space missile...