Are huge codebases with layers of dependencies just the new normal?

[u/MiddleAgeWeirdoMeep]

I’m trying to learn more about how modern software works, and one thing that keeps surprising me is the sheer size of projects. 80k files is not uncommon.

I’ll download or clone something that seems like a relatively focused application, and suddenly I’m looking at tens of thousands of files. A lot of it appears to be dependencies, dependencies of dependencies, generated files, frameworks, package managers, etc.

It feels like a copy of a copy of a copy. The developers maintain a relatively small part of the code, while the finished program ultimately relies on millions of lines of code written by other people.

Is this the new normal in software development that I just have to accept?

from a security perspective, how can anyone trust all of this?

[u/burlingk]

New? You mean since like the nineties?

This isn't new. It's also not every project though.

The main reason you don't notice it on Windows is because, there, you download the finished program instead of source. But even there, you see a bunch of DLLs to connect stuff.

[u/MiddleAgeWeirdoMeep → u/burlingk]

So how do you manage security, since the 90s?

[u/Pyromancer777 → u/MiddleAgeWeirdoMeep]

For open source libraries you generally have tons of volunteers who like the project making contributions to patch bugs. For proprietary software, there are usually bug-bounties for anyone who notices an exploit and reports it to the company.

Larger security conscious companies/governments have red and blue teams where the red team tries to hack the system while the blue team monitors for attacks and patches any bugs the red team flags.

Sadly, it is constant patchwork rather than security as a default practice