Editing Talk:2347: Dependency

<!--Please sign your posts with ~~~~ and don't delete this text. New comments should be added at the bottom.-->
I worked for the Linux Foundation on the Core Infrastructure Initiative supporting OpenSSL and other projects. The one that scared me was Expat the XML parser maintained by two people on alternate Sunday afternoons assuming no other distractions. We did  get funding for a test suite. Joe Biden was a supporter of LF and CII and was going to host a fund raiser for us at the White House until a perverse result.[[Special:Contributions/141.101.98.222|141.101.98.222]] 22:46, 17 August 2020 (UTC)

:Are you trying to tell me that Biden and Harris weren't for CALEA, DIETYBOUNCE, and similar backdoors just like all the feds? When will they discover how to stop sending money overseas? https://blog.risingstack.com/controlling-node-js-security-risk-npm-dependencies/ [[Special:Contributions/172.69.34.18|172.69.34.18]] 07:37, 25 August 2020 (UTC)

In the explanation, is "far from the days of backwards compatibility" a reference to something specific? I thought quite a few things made today were still backwards compatible, or am I mistaken? [[User:Zowayix|Zowayix]] ([[User talk:Zowayix|talk]]) 18:26, 30 August 2020 (UTC)

;Relevance of Imagemagick?

Could someone perhaps add to the explanation an explanation of how this applies to Imagemagick (as mentioned in the title text)? —[[Special:Contributions/108.162.219.174|108.162.219.174]] 22:58, 17 August 2020 (UTC)
:I don't use it myself, but it is a very versatile standalone utility that does a lot through command-line (batched) processing or can be accessed through actual API interface (I use GIMP tools that way, in automation, when not using it directly as a manual interface, but I understand there's a lot of love out there for IM). There's potentially untold uses for that, hidden in the background of other applications. If it disappeared or changed in just the wrong way, could perhaps half the CAPTCHA dialogues suddenly break? Could a self-driving car company find its vehicles are suddenly blind? We might suddenly have so many fewer Doge memes! (Wow! Much up-to-datedness! So topical!). 
: In Randall's (or his characters') world, that is. In our world, I see someone mentioned Leftpad in the Explanation, which probably needs more Explanation (or else wikilinking) but is an interesting thing that actually happened in our world, albeit not ''quite'' armagg3don for society... [[Special:Contributions/162.158.154.131|162.158.154.131]] 23:22, 17 August 2020 (UTC)
: Imagemagick is the de-facto standard for Image processing. Since the 90's engineers were either adding support for new formats to ImageMagick or adding new language bindings for ImageMagick. This resulted in a single library that is available on almost every server and desktop platform and can read and write almost every image format. Using imageMagick is sometimes unwieldly. e.g. on nodeJS it actually spawns a sub-process to run imagemagick. But it is still the de-facto (and the only practical) choice in most cases.--[[User:Deepjoy|Deepjoy]] ([[User talk:Deepjoy|talk]]) 00:24, 18 August 2020 (UTC)
:: I would put emphasis on the "almost every image format" ... there are lot of alternative image libraries, but most only support handful of formats (often just jpeg, png and gif). Meanwhile, I suspect not even Gimp supports as many formats as ImageMagick ... and, of course, Gimp is not really usable as library OR for shelling-out. -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 23:43, 18 August 2020 (UTC)
::: The massive reliance on ImageMagick was recognized in 2002 by the developers of {{w|GraphicsMagick}} who needed to guarantee a stable version of ImageMagick and created their own fork. So while almost everyone uses and depends on ImageMagick (or think they are using ImageMagick when they are actually using GM) there is an actively maintained alternative. -- [[Special:Contributions/162.158.159.48|162.158.159.48]] 17:10, 21 August 2020 (UTC)

;from the late 2010s onwards? 

I'm pretty sure re-use and modularization was a thing long before then. Maybe it got more popular in the 2010s, but it's been around since at least the '70s. {{unsigned ip|108.162.250.65|23:24, 17 AUgust 2020 (UTC)}}
: The ideal of reusable code libraries has been around for nearly ever, but except for some popular Fortran statistics libraries I don't think it achieved widespread achievement until much later, e.g. CPAN. [[User:Barmar|Barmar]] ([[User talk:Barmar|talk]]) 03:25, 18 August 2020 (UTC)p

The timezone database (https://en.wikipedia.org/wiki/Tz_database#History) has been around since 1986. libc in various forms has been around as long as C has. Reuse and modularity is a fundamental principle of software engineering, and not an invention of the last few years. I'd just remove any mention of date. {{unsigned ip|141.101.69.71|08:11, 18 August 2020 (UTC)}}
: I think it's relatively recent that you can delete a file from one Web server and everything on the internet breaks.  Dependencies are one thing, dependency on live updated resources is new.  Because it's rather a bad idea.  Incidentally overall...  I think today's comic needs to be explained slower.  Most people in the world are very unfamiliar with these concepts.  Although coronavirus responses have taught a lot of us about "supply chains" that put stuff into shops for us to buy. Robert Carnegie rja.carnegie@excite.com [[Special:Contributions/141.101.69.87|141.101.69.87]] 10:18, 18 August 2020 (UTC)

:: While libc in various forms has been around as long as C has, it was never SINGULAR. Every version of C compiler had it's own version of C library maintained by different people. Even now there are alternatives to GNU libc. The timezone database might be better example. Also, reuse and modularity is fundamental principle, but reusing code maintained by someone else in project with bigger staff than that of such code is relatively recent. -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 23:48, 18 August 2020 (UTC)

;This has happened before 

It may be worth mentioning a case where this actually happened, like https://www.theregister.com/2016/03/23/npm_left_pad_chaos/ [[Special:Contributions/141.101.97.101|141.101.97.101]] 01:03, 18 August 2020 (UTC)
: That was only a problem for those who tried to compile against network versions, instead of having a local copy. One of the dumbest and laziest things you can do as a programmer. Not to mention that you could just copy the code directly into one of your files or just writing your own routine. [[User:SDSpivey|SDSpivey]] ([[User talk:SDSpivey|talk]]) 02:04, 20 August 2020 (UTC)
:: Speaking as a SecDevOps person, another risky thing programmers do out of ignorance is host static local copies of code repositories without a good update and security review plan to make sure the static copy gets regular testing and updates as security and bugfixes are published to the source. Still another risk is writing your own library to reinvent the wheel and making the same mistakes the maintainer of the wheel solved six major versions ago. I would be careful throwing terms like "dumb" and "lazy" around. Every one of those solutions, including your proposals, *also* can be risky if implemented without proper expertise and forethought. There is no 'best' practice here, just risks and advantages that make it so that there is no single one-size-fits-all solution [[Special:Contributions/108.162.212.145|108.162.212.145]] 13:30, 27 August 2020 (UTC)

One particularly big risk that instantly came to mind is the timezone database, which is maintained by volunteers yet underpins basically everything: https://en.wikipedia.org/wiki/Tz_database#Maintenance

I remember hearing about this a few years back at a Linux Foundation conference - the NTP daemon was underfunded (as I recall) and the one person maintaining it was struggling to pay bills.  Losing NTP breaks an awful lot of things.... [[Special:Contributions/162.158.107.167|162.158.107.167]] 19:48, 18 August 2020 (UTC)

: I see this was [https://www.infoworld.com/article/3144546/time-is-running-out-for-ntp.html problem in 2016] ... I'm not able to find any update on the situation ... -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 00:10, 19 August 2020 (UTC)

:: [https://twit.tv/shows/floss-weekly/episodes/350 Nice long interview with Harlan Stenn, author/maintainer of NTP]. [[User:RandalSchwartz|RandalSchwartz]] ([[User talk:RandalSchwartz|talk]]) 05:56, 19 August 2020 (UTC)

: I work with a E100k robot that keeps breaking on account of [[http://atomicparsley.sourceforge.net/ Atomic Parsley]].  Everyone is very amused at this [[User:Kev|Kev]] ([[User talk:Kev|talk]]) 13:32, 20 August 2020 (UTC)

;Some random person in Nebraska 

Is the reference to a random person in Nebraska totally arbitrary, or is it a reference to someone in particular?

Also, it would be good to have examples of heavily used projects with very small (especially one person) maintainer teams. OpenSSL definitely comes to mind, from what I have read. [[User:Stevage|Stevage]] ([[User talk:Stevage|talk]]) 01:49, 18 August 2020 (UTC)

Nebraska came up in 1667, "Algorithms" as well.[[Special:Contributions/162.158.79.33|162.158.79.33]] 02:22, 18 August 2020 (UTC)
:Nebraska is... Well, I'm sure some Nebraskonians might have a more fully-fleshed out and accurate opinion of its subtleties, depth of culture(s?) and Deity-given geographic artisanship but viewed from further afield it is one of the contenders for "miles and miles of not much going on", or similar, peopled by people that largely live within that promise.
:It may be just a [https://wiki.lspace.org/mediawiki/Power_Cable meme of such a generality], as a brief look at a {{w|List_of_people_from_Nebraska|list of people from Nebraska}} tends to support the hypothesis that the ones who became significant (Astair, Brando, Carson...) probably did so only once they left.
:OTOH, there are (at least) four computing pioneers/developers mentioned among them, creator or authors of significant 'products', and maybe {{w|Sketchpad|one of these}} matches the (intellectual) dependency meme quite well - other than being written in Massachusetts. Or {{w|Blogger_(service)|this one}}, though that might have been LA-baked, maybe?
:I learnt [[1053|some interesting things]] when investigating this issue, just now. Cheers! [[Special:Contributions/108.162.229.142|108.162.229.142]] 09:54, 18 August 2020 (UTC)
:I feel like Nebraska is mentioned just because ot's the.most flyover-sounding flyover state name? Or is it actually home to some well known library maintainer? {{unsigned|162.158.119.199|07:42, 21 August 2020 (UTC)}}
:Another good example might be left-pad. It actually caused a big issue [https://www.theregister.com/2016/03/23/npm_left_pad_chaos/ in 2016] when the developer took it offline and a whole bunch of projects and websites broke. [[User:Numbermaniac|Numbermaniac]] ([[User talk:Numbermaniac|talk]]) 07:41, 22 August 2020 (UTC)

;Microservices reference 
Microservices reference is not related to this comic, as ImageMagick is monolith application. Also microservices are way of operating and deploying web services, not utility apps.
[[Special:Contributions/162.158.103.177|162.158.103.177]] 07:56, 18 August 2020 (UTC)

:ImageMagick is a library. -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 23:50, 18 August 2020 (UTC)

;The Thirty Million Line Problem 
See [https://www.youtube.com/watch?v=kZRE7HIO3vk The Thirty Million Line Problem]. Randall's drawing looks like a house of cards on the verge of collapse. In the video, Casey talks about how the lack of a "hardware ISA" causes critical software (like OS'es and browsers) to bloat like crazy (a "hardware ISA" would be a standard for how hardware works, just like the x86 ISA is a standard for how an x86 CPU works, that both AMD and Intel agrees on). Also, he mentions how fragile and broken software is due to this "Thirty Million Line" bloat. {{unsigned ip|162.158.134.90|

:Based on [https://www.reddit.com/r/programming/comments/8iyqk9/the_thirty_million_line_problem/ related discussion], that's a VERY bad video: he may have a point, but it takes VERY long time before he gets to it. I'm not going to watch it that long myself. -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 00:03, 19 August 2020 (UTC)

:This reminds me of that old joke: If carpenters built buildings the same way programmers made programs, the first woodpecker that came along would destroy civilization. {{unsigned ip|162.158.106.160|14:29, 19 August 2020 (UTC)}}
::(Known as "Weinberg's Law" from 1971 "Psychology of Computer Programming", G.M. Weinberg [https://quoteinvestigator.com/2019/09/19/woodpecker/] ) {{unsigned ip|172.68.126.139|23:37, 20 January 2024}}

: I thought the drawing looks more like the [[w:Jenga|Jenga]] game, except the components are not simple rectangles. [[User:Barmar|Barmar]] ([[User talk:Barmar|talk]]) 16:31, 20 August 2020 (UTC)

;"Famous" Left Pad Incident 
The "famous" left-pad incident in JavaScript's package manager could use some elaboration for those of us for which it isn't. [[Special:Contributions/162.158.107.89|162.158.107.89]] 02:42, 19 August 2020 (UTC)

:Aaaaand that's why i'll never use kik [[Special:Contributions/172.70.251.108|172.70.251.108]] 09:47, 17 June 2022 (UTC)

::I feel blaming the "disgruntled" (a loaded term in itself) open-source developer for withdrawing from an "open source" platform that screwed him over in favor of corporate interests is a misrepresentation of the incident. [[Special:Contributions/172.70.38.26|172.70.38.26]] 15:18, 26 June 2024 (UTC)

;Log4j Zero-Day Vulnerability Incident
On December 9, 2021, security researchers discovered a flaw in the code of a software library used for logging. The software library, Log4j, is built on a popular coding language, Java, that has widespread use in other software and applications used worldwide. This flaw in Log4j is estimated to be present in over 100 million instances globally. This vulnerability and associated attacks against it are being characterized as Log4Shell in the cybersecurity community. {{unsigned|Clivern|20:00, 14 January 2022 (UTC)}}

;Loadsharers 
There is an initiative by Eric Raymond targeted specifically to mitigate this problem.<br>
Article: https://www.linuxjournal.com/content/loadsharers-funding-load-bearing-internet-person<br>
Website: https://esr.gitlab.io/loadsharers/ &emsp; &mdash; [[User:Smartchair|Smartchair]] ([[User talk:Smartchair|talk]]) 16:20, 19 August 2020 (UTC)

;NTP
The [https://www.informationweek.com/it-life/ntp-harlan-stenn-and-an-uncertain-future-readers-react/d/d-id/1319521 Network Time Protocol] is also a great example. --[[User:Slashme|Slashme]] ([[User talk:Slashme|talk]]) 21:50, 19 August 2020 (UTC)

[https://www.ardmediathek.de/video/aktuelle-stunde/angeklickt-sicherheitsluecke-in-log4shell/Y3JpZDovL3dkci5kZS9CZWl0cmFnLWNhOWUzZWE5LWU1NmEtNGRiOC04OWEzLTZhZWE1MTNhMmU0Nw/ German Television] referencing this comic to illustrate the Log4j dependency (at around 1:11) {{unsigned ip|162.158.94.161|16:54, 19 December 2021 (UTC)}}

;Explain “maintenance” 
What this article does a poor job of is explaining what software “maintenance” is. Software doesn’t usually disappear (despite the several cases mentioned in the article which are kind of beside the point). It also doesn’t rust or wear out  like a car. But software usually needs to be continuously updated to fix security vulnerabilities or to keep it compatible with other software. Also it can get new features or bug fixes. And if the guy in Nebraska doesn’t do a good job of it, everyone has a problem.

Also worth mentioning is how the comic highlights the absurdity of this anarchic communism. Neither users (capitalism) nor the government (socialism) is paying these people. And somehow it works 95% of the time. Except when it doesn’t. {{unsigned ip|141.101.104.69|21:05, 19 January 2024 (UTC)}}

;Duplicity 
Saw this cartoon and immediately thought of the backup software Duplicity, which comes with Ubuntu (using Deja-Dup interface). Big shout-out to Kenneth Loafman for keeping it running! [[Special:Contributions/108.162.238.124|108.162.238.124]] 16:06, 7 February 2024 (UTC)

;xz Backdoor 
The xz backdoor has brought up an even more disturbing ramification of this situation, which is that a malicious entity (e.g. a nation-state) can create a persona (or multiple), build trust with the random guy maintaining the library since 2003, eventually take over the project, then implant a backdoor that targets core software like OpenSSH.  '''The only reason we just avoided one of the largest cyber incidents in history is because one guy running Debian Sid noticed sshd using a ''bit'' more CPU than normal while he was benchmarking something completely unrelated.'''  The implications here are '''terrifying'''.
[[Special:Contributions/172.70.210.131|172.70.210.131]] 20:02, 30 March 2024 (UTC)

:I wonder how many times that has already happened. Not *if*, but how many times. See also the title text of  [[2057:_Internal Monologues|xkcd 2057 (Internal Monologues)]]. [[Special:Contributions/172.70.46.34|172.70.46.34]] 14:24, 8 May 2024 (UTC)

;Concept of vulnerability thru dependency rests mostly on this cartoon 

On July 11th, 2024, a version of this cartoon re-labelling "all modern digital infrastructure" to "every conversation about dependencies since 2020", and in which the lynchpin block is now labelled "this fucking comic" [https://mastodon.social/@mhoye/112765357274419363 first appeared on the fediverse social networks]. This variant turns the cartoon into a self-referencing one, where conceiving the vulnerability thru dependency rests mostly on the cartoon that illustrates this very concept. This ''mise en abyme'' was soon illustrated by [https://swiss.social/@LukePhilipps/112766542874352677 a further variant of the cartoon] making use of the {{w|Droste effect}}. --[[Special:Contributions/172.71.130.67|172.71.130.67]] 21:27, 11 July 2024 (UTC)

;2025 Cloudflare and AWS outages 
Reddit [https://www.reddit.com/r/CloudFlare/comments/1p0abms/the_entire_internet_lol/ had fun] with the AWS and Cloudflare outages in late 2025.  The Cloudflare outage was on 18 November, the AWS outage a few weeks before that. [[Special:Contributions/64.201.132.210|64.201.132.210]] 21:29, 18 November 2025 (UTC)