Re: [gentoo-dev] [PATCH 3/3] dev-vcs/hub: migrate to go-module.eclass

[Kent Fredric <kentnl@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 2232 bytes --]

On Fri, 13 Sep 2019 12:50:48 -0400
Michael Orlitzky <mjo@gentoo.org> wrote:

>  The rule "don't copy and paste code" applies to your
> linker just as much as it applies to the first program you wrote in
> CS101, and for the same reasons.

My experience has taught me to ignore the rule as written, and consider
it more a guideline aimed at novices.

Importantly, don't copy and paste code you don't understand.

However, if you re-use a given implementation, you can sometimes become
dependent on specifics in that implementation.

And upstream have an annoying tendency to change implementation details
in incompatible ways.

This breaks your code, sometimes obviously, sometimes subtly.

So the benefit you'd hoped to attain by modularity only remains true if
the modules in question are immutable for the problem you're using them
for.

Also, these external modules bring with them complexity you may not
want or need (and their own dependencies with the same issues), and
that's not free either.

Subsequently, when considering a new dependency, I have to ask
questions about whether I can implement a subset of the dependency
faithfully that suits my needs, and ask if I have the skills to be an
expert in this implementation.

A level of distrust in the people who author and maintain your
dependencies is something I consider healthy.

Does this map at all to static linking? You bet.

And that's part of why Go and Rust use it.  The fragility of
other-peoples code in the long view of time is high, because with
dynamic linking, you don't have any guarantees about integrity.

You have to cross your fingers and hope upstream so-named their
libraries right, hope upstream changed their API markers right, hope
upstream never accidentally made a breaking change without changing an
API marker, hope your code doesn't need a mountain of work to recompile
after the API marker changes, and hope upstream/gentoo maintainers for
your package can still be bothered to ship fixes for the API consumer.

That last paragraph sums up a large volume of the daily hell of being a
maintainer and a gentoo user.

Static linking is more a result of a sickness, not the sickness itself.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]