Dependency (xkcd.com)

808 points by kjhughes · 2235 days ago · 294 comments on HN

Article summary

The article discusses the concept of dependency, where a single piece of software or library is crucial to the functioning of many other systems. This can create a vulnerability if the maintainer of the dependency is unable or unwilling to continue supporting it. The article does not provide specific examples, but the comments section is filled with discussions of various dependencies that fit this description. These dependencies are often maintained by a single person or a small group, which can be a risk if something happens to them.

Main themes

dependency risk
single point of failure
alternative implementations
funding and support
community involvement
bus factor
software maintenance
vulnerability and risk
open-source software
critical infrastructure dependencies
maintainer burnout
dependency management
system resilience
technology ecosystem
software development
systemic risk
open-source sustainability
dependency graph
software supply chain
critical dependencies
systemic vulnerability
software ecosystems
technology interdependence
dependency hell
system fragility
software fragility
critical software
systemic fragility
dependency management strategies
software dependency
systemic risk management
open-source dependency
technology dependency
systemic vulnerability management
dependency mitigation
system resilience strategies
software ecosystem resilience
technology ecosystem resilience
systemic resilience
dependency risk management
software risk management
systemic risk mitigation
open-source risk management
dependency strategies
systemic strategies
technology strategies
software strategies
resilience strategies
mitigation strategies
management strategies
risk management strategies
vulnerability management strategies

What commenters say

Some dependencies, like OpenSSL and SQLite, are crucial to the functioning of many systems and are maintained by a small group of people.
The maintainer of a dependency can be a single point of failure, as seen in the case of core-js, where the sole maintainer was sentenced to prison.
Alternative implementations can mitigate the risk of a single dependency, as seen in the case of NTP, which has multiple implementations.
Some dependencies, like ImageMagick, have a bus factor of 1, meaning that if the maintainer is unable to continue supporting it, the entire system could be at risk.
Funding and support from large companies can help ensure the continued maintenance of critical dependencies.
The use of dependencies can be a double-edged sword, providing convenience and functionality but also introducing risk and vulnerability.
In some cases, dependencies can be replaced or forked if the maintainer is unable or unwilling to continue supporting them.
The community can come together to support a dependency, as seen in the case of GPG, where the community helped the maintainer continue working on the project.
Some dependencies, like SQLite, have a successful business model that allows them to continue maintaining and supporting the software.