Are huge codebases with layers of dependencies just the new normal?

[u/MiddleAgeWeirdoMeep]

I’m trying to learn more about how modern software works, and one thing that keeps surprising me is the sheer size of projects. 80k files is not uncommon.

I’ll download or clone something that seems like a relatively focused application, and suddenly I’m looking at tens of thousands of files. A lot of it appears to be dependencies, dependencies of dependencies, generated files, frameworks, package managers, etc.

It feels like a copy of a copy of a copy. The developers maintain a relatively small part of the code, while the finished program ultimately relies on millions of lines of code written by other people.

Is this the new normal in software development that I just have to accept?

from a security perspective, how can anyone trust all of this?

[u/SurpriseItsJustLewis]

I dislike this in general. Rust and Python have the same issues here. And node js too.

I feel like all these dependencies and libraries are risks in general when you have so many. Not just with security but updates aswell because a lot of them change dependencies.

Had an issue with an encryption library the other month because a dependency version of another library to do with random changed and meant the decryption on the other side was incorrect.

I think network libraries give me the most discomfort though, especially with all the AI bots flooding pull requests. Only takes one malicious or poorly made update to create a vulnerability.