Editing 2140: Reinvent the Wheel

Jump to: navigation, search

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision Your text
Line 14: Line 14:
 
The point of the comic is to make fun of programmers who take the idea that you should never reinvent the wheel too seriously. When these people have a problem, they may Google to find a solution to that problem, and when they find a piece of online code, they use it in their own code, even if it wasn't initially designed to handle the task for which it is being used and thus may have unintended side effects or other issues.
 
The point of the comic is to make fun of programmers who take the idea that you should never reinvent the wheel too seriously. When these people have a problem, they may Google to find a solution to that problem, and when they find a piece of online code, they use it in their own code, even if it wasn't initially designed to handle the task for which it is being used and thus may have unintended side effects or other issues.
  
βˆ’
Another way that programmers may go too far in avoiding reinventing the wheel is in using external dependencies. It can be valuable to use external libraries, especially for applications where certain tasks have strange edge cases that a 'reinvention' is likely to miss or require lots of development effort to correctly implement (like [https://infiniteundo.com/post/25326999628/falsehoods-programmers-believe-about-time time]). However, using someone else's code means taking on the risk of security vulnerabilities, and when the library is updated on live installations, the user also takes on the risk that the library might become unavailable or otherwise break.  In this case, Beret Guy's company updates their wheel "library" on a daily basis from Google's image search. Google is unlikely to shut down a core search product, but they might change the API that Beret Guy's company uses (unless he's just going to their website himself), and they have been known to shut down projects that people like, such as [https://www.google.com/reader/about/ Google Reader]. On the day this comic was released, Randall changed the [[Design_of_xkcd.com#Header_text|Header text]] of xkcd, adding a [[Header text#2019-04-23_-_Google_Reader|reference to Google Reader]].
+
Another way that programmers may go too far in avoiding reinventing the wheel is in using external dependencies. It can be valuable to use external libraries, especially for applications where certain tasks have strange edge cases that a 'reinvention' is likely to miss or require lots of development effort to correctly implement (like [https://infiniteundo.com/post/25326999628/falsehoods-programmers-believe-about-time time]). However, using someone else's code means taking on the risk of security vulnerabilities, and when the library is updated on live installations, the user also takes on the risk that the library might become unavailable or otherwise break.  In this case, Beret Guy's company updates their wheel "library" on a daily basis from Google's image search. Google is unlikely to shut down a core search product, but they might change the API that Beret Guy's company uses (unless he's just going to their website himself), and they have been known to shut down projects that people like, such as [https://www.google.com/reader/about/ Google Reader]. On the day this comic was released, Randall changed the [[Design_of_xkcd.com#Header_text|Header text]] of xkcd, adding a [[header_text#2019-04-23_-_Google_Reader|reference to Google Reader]].
  
 
The popular programming language Python manages external dependencies with packages called "wheels" which are "published to the cheese shop", which may or may not be an intended reference.  
 
The popular programming language Python manages external dependencies with packages called "wheels" which are "published to the cheese shop", which may or may not be an intended reference.  
Line 32: Line 32:
 
*On the day this comic came out a Google search on Wheel would in some cases have a bicycle wheel at the top:
 
*On the day this comic came out a Google search on Wheel would in some cases have a bicycle wheel at the top:
 
:[[File:2140_Reinvent_the_Wheel_Google_Search_Wheel.png|400px]]
 
:[[File:2140_Reinvent_the_Wheel_Google_Search_Wheel.png|400px]]
βˆ’
*The JavaScript development community has had several security and reliability incidents caused by over-dependence on automated package updates.  In 2016, a JavaScript developer [https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ un-published several libraries] (including one "library" which was just an eleven-line function for padding strings, which was nevertheless included in thousands of projects and downloaded millions of times a month) from the npm package repository.  This broke projects that depended on them and, until npm un-un-published his packages (with new maintainers), also opened the possibility that a bad actor could register malicious projects under those names and hijack all of their dependents. In July 2018, an attacker gained access to the npm account of an ESLint maintainer and [https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes published malicious versions of their packages], and in September 2018, the event-stream library was taken over by a malicious maintainer who [https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/ added code to look for and steal bitcoins from the users who installed it].
+
*The JavaScript development community has had several security and reliability incidents caused by over-dependence on automated package updates.  In 2016, a JavaScript developer [https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ un-published several libraries] (including one "library" which was just an eleven-line function for padding strings, which was nevertheless included in thousands of projects and downloaded millions of times a month) from the npm package repository.  This broke projects that depended on them and, until npm un-un-published his packages (with new maintainers), also opened the possibility that a bad actor could register malicious projects under those names and hijack all of their dependents. In July 2018, an attacker gained access to the npm account of an ESLint maintainer and [https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes published malicious versions of their packages], and in September 2018, the event-stream library was taken over by a malicious maintainer who [https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/ added code to look for and steal bitcoins from the users who installed it].
  
 
{{comic discussion}}
 
{{comic discussion}}

Please note that all contributions to explain xkcd may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see explain xkcd:Copyrights for details). Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following CAPTCHA:

Cancel | Editing help (opens in new window)