Jeff Terrell: Okay today we're going to continue our discussion of architecture, I think I had said last time that we were going to start talking about layout today.
Jeff Terrell: And then I started reviewing kind of what I had planned and expanded a few things and we might get to lay out today, we might not if we don't we'll pick up there, next time i'm going to reserve some time at the end of class for quiz number two.
Jeff Terrell: But let's begin to architecture.
Jeff Terrell: Today, with respect to architecture i'm going to talk a little bit about just to carry over from last time talking about frameworks versus libraries.
Jeff Terrell: And how.
Jeff Terrell: The difference between those things might influence what choices, you make with respect to architecture.
Jeff Terrell: i'll talk about dependencies get a little bit philosophical about dependencies and and constraints, but.
Jeff Terrell: Talk about.
Jeff Terrell: What finances are with the by you and.
Jeff Terrell: Then we'll talk about web and mobile APP choices different approaches to doing web Apps and mobile Apps this is kind of high level.
Jeff Terrell: categories of approaches to.
Jeff Terrell: This but hopefully this will be useful to at least some of you, and if we have time we'll get to lay out.
Jeff Terrell: Sorry, somebody raising a hand or something.
Jeff Terrell: Top of that screen got cut off, so I wasn't quite sure what that was anyway okay.
Jeff Terrell: I assume anybody online is going to speak up in in chat or or maybe raise your hand if you want to have a question.
Jeff Terrell: Okay, so to carry over from last time frameworks versus libraries so.
Jeff Terrell: there's actually a pretty useful distinction between frameworks and libraries.
Jeff Terrell: library is code that you call for the somebody else wrote that you call in your code.
Jeff Terrell: So you're basically in control here you decide when to call this code, how to call this code course, you have to do it in a way that the code understands, you have to obey the API that that library provides but you're in control.
Jeff Terrell: Framework is the other way around, some.
Jeff Terrell: The other code is actually in control and it's going to call your APP and a call your code when it chooses to.
Jeff Terrell: Right so examples of libraries would include like let's say you had a library, to give you a canvas and let you draw lines and shapes on this canvas.
Jeff Terrell: Maybe you get to save it as an image, or something like that that'd be a library you get to decide when to create the canvas when did draw shapes when to export the canvas to an image you're in control.
Jeff Terrell: Maybe there's a library of play sound effects.
Jeff Terrell: you decide what to play when to plant your code is in control.
Jeff Terrell: or there's a library generate qr code images again because you're using a library, you are in control.
Jeff Terrell: But a framework being code that somebody else writes that is going to invoke your Code, the framework is in control examples of this would include rails django on the back end angular js ember js it's a little outdated these days flutter.
Jeff Terrell: react native android Java spring.
Jeff Terrell: So a lot of examples of frameworks.
Jeff Terrell: And this is code that invokes your code right so.
Jeff Terrell: let's analyze frameworks versus libraries.
Jeff Terrell: frameworks tend to be more difficult to understand.
Jeff Terrell: It tend to be more difficult to understand.
Jeff Terrell: They tend not to be simple there's usually a lot of stuff going on in a framework, sometimes there is in libraries to, but not necessarily libraries, sometimes can be.
Jeff Terrell: Pretty single purpose pretty simple it's easy to wrap your head around and figure out when do you want to use it in because you're in control you use it when you want, and it kind of one of the tools in your toolbox, and when you don't need it it's just on your shelf.
Jeff Terrell: But frameworks.
Jeff Terrell: You have to kind of understand that so um.
Jeff Terrell: yeah sometimes you can just follow the easy path on a framework it'll say you know the getting started guide that we going through the.
Jeff Terrell: um I don't know the angular js docs and learn how to get started using angular js.
Jeff Terrell: And if you just stay on that easy path then maybe you don't really need to understand everything that's going on in the framework.
Jeff Terrell: But, before long, you might need to start understanding things, maybe things aren't working as you expect maybe you try to do something different than what the getting started guide outlines for you and you can under the problems if you don't understand what the framework is doing.
Jeff Terrell: Imagine starting a new job.
Jeff Terrell: you'd have to learn what's expected of you.
Jeff Terrell: Right, this is kind of like using a framework, you have to learn what's expected of you in writing, your code in order to let the framework call your code and have the result that you want to happen happen.
Jeff Terrell: Something else that is kind of tricky about framework sometimes is that there can be difficulties around version upgrades.
Jeff Terrell: So you started on.
Jeff Terrell: Well, I personally experienced this with rails rails as a back end framework for Ruby.
Jeff Terrell: You started on version say three of rails and then over time version three very security issues are and are noticed by different people and.
Jeff Terrell: New features are being developed for version for and at some point, you can upgrade to version four.
Jeff Terrell: And at some point in the future, you have to upgrade away from version three because version three is deprecate it no longer supported subject to various security issues, etc.
Jeff Terrell: So you're going to be facing that have created some point, and when you make that version jump from three to four things change the framework changed, and there are breaking changes in that framework where.
Jeff Terrell: You were your code was the certain shape and now that's no longer going to work, the version four so you have to go and fix find all those things and fix them so in order to upgrade to version four and this might happen once a year.
Jeff Terrell: it's gonna be pretty painful and, hopefully, you have a good set of tests so you're going to help you identify when something broke.
Jeff Terrell: But if not you're kind of in the dark like I i'm going to just do what they say, hopefully it's going to work I don't know.
Jeff Terrell: So this is one this is kind of like the.
Jeff Terrell: Often on advertise downside of frameworks question.
Jeff Terrell: Good question is anybody working on this problem, why is it still a problem I think it's a problem because frameworks tend to be big people like big frameworks that do a lot for you.
Jeff Terrell: And sometimes people, especially if you're trying to innovate in this space you're trying to add new things to your framework to attract users to your framework because it's better.
Jeff Terrell: For for different reasons, maybe it organizes the code better or something like that um and so you're trying things out you're a little bit experimental and then later on, you realize add that really didn't work so well, I need to change that and that's when you have a breaking change.
Jeff Terrell: I would say the solution to this is to focus kind of maybe relentlessly on simplicity and to use it use libraries that are single purpose.
Jeff Terrell: find a library that as this library, that does not elaborate that does that specialist together and hope that you control it doesn't avoid all problems and we'll see some other problems that can cause but.
Jeff Terrell: I think, using libraries and focusing more on simplicity, can help avoid a lot of those headaches.
Jeff Terrell: And question.
Jeff Terrell: Other questions.
Jeff Terrell: Alright, so that was frameworks versus libraries who's giving you kind of a way to think about this as you're evaluating how to organize your code what the architecture of your APP is going to be.
Jeff Terrell: I want to talk about trade offs and dependencies I think this will be useful for you as well.
Jeff Terrell: So, generally speaking.
Jeff Terrell: The reason that you depend on something is because of some benefit that you've arrived from depending on.
Jeff Terrell: What the downside is that you cede control to the thing that you're depending on.
Jeff Terrell: Speaking very generally here not just about software dependencies but about any dependency.
Jeff Terrell: So when you're using some sort of dependency that means you might not get it exactly your way.
Jeff Terrell: It might not be 100% reliable, you might not get it, or you might not get it when you need it.
Jeff Terrell: or when you want it.
Jeff Terrell: And so the main question of using a dependency is is it worth it, because the the value of the benefits exceed the cost.
Jeff Terrell: and, obviously, it depends right it depends on the dependency depends on what you're trying to do, but I wanted to be explicit about what that trade off is so that we could actually have a reason to discussion about it, and that you can make mindful choices about finances.
Jeff Terrell: So some examples we include delegating work to an employee.
Jeff Terrell: benefit is, you have to do that's right it's pretty good benefit, but the downside is that it might not picked on might not get done on time, or it might not get done to your satisfaction.
Jeff Terrell: Or, if you have a company, you have a start a software startup and you have a really great product but.
Jeff Terrell: you're not a sales or marketing expert, that would be me and then in this in this role before maybe you partner with another company for sales and marketing help.
Jeff Terrell: They can help you but there's downside, for one thing you might be probably gonna have to pay them, maybe they get a cut of Commission maybe they have to pay them a certain amount per month.
Jeff Terrell: But the marketing message might not be quite what you wanted sales might not happen, the way that you want right now you're giving up control right.
Jeff Terrell: A classic dependency that most people are going to choose, in this day and age is if they need to run some sort of infrastructure they're going to look for ways to let other people run that infrastructure and you.
Jeff Terrell: may just have to rent it or or pay by the hour or something like that this is the classic cloud computing value proposition.
Jeff Terrell: there's so much stuff in the cloud these days and that's why it's because many people have made this trade off and said, it is worth it to me not to have to mess with infrastructure.
Jeff Terrell: So, so that I can save myself a lot of time and i'm certainly willing to cede control over that infrastructure, if I can just pay somebody else to do it.
Jeff Terrell: And even a library right if you use a library or framework for that matter.
Jeff Terrell: you're doing that, instead of writing whatever code, you need to write yourself.
Jeff Terrell: You could give it enough time right all the code that you needed to write yourself.
Jeff Terrell: I suppose given enough time you could design the hardware and right the os and the device drivers and and the machine language, processors and all that.
Jeff Terrell: And right all the way up to you know protocols tcp and IP and may show up and then a web APP, and all this kind of stuff so you're probably not going to do that, but.
Jeff Terrell: Even so, every every choice that you make about taking a dependency yeah you save time you don't have to write that code, but.
Jeff Terrell: you're giving up control.
Jeff Terrell: And the key idea here is that when you depend on something else you are implicitly trusting that thing that you depend on.
Jeff Terrell: You if you get nothing else about dependencies understand that we depend on something else you're trusting it.
Jeff Terrell: you're not just trusting that it will work for that it won't break you're also trusting and for security.
Jeff Terrell: In an example of where once that's an assumption has gone awry in the past.
Jeff Terrell: And you're basically bringing code that somebody else wrote into your application and depending on your use case in your application, maybe that's completely fine.
Jeff Terrell: But if, as is the case in the case study here in a minute perhaps you're writing code that is going to securely store wallets of bitcoin.
Jeff Terrell: And cryptocurrencies for other users, maybe in that case you need to be a lot more careful about bringing in code that somebody else wrote into your application, because I could could do any.
Jeff Terrell: Generally speaking, this is always fine until it isn't.
Jeff Terrell: Until you get bitten by it until something happens, but it is just what I want you to get it's just a bit more mindfulness about making this choice.
Jeff Terrell: So how can you predict what somebody out there might do to violate your trust.
Jeff Terrell: you're going to have to justify your technology choices and assignment six if you haven't seen that that's talking about your application architecture, you will be creating architecture decision records.
Jeff Terrell: Just just a record of you know, we made a decision to use this architecture and not that not that architecture.
Jeff Terrell: So this could be useful.
Jeff Terrell: Alright let's talk about left pat anybody heard this story before left add.
Jeff Terrell: One one couple okay.
Jeff Terrell: Most of you haven't noticed this, this is a good story this comes from March 2016.
Jeff Terrell: This person I don't know how to say his name.
Jeff Terrell: ACER I guess publishes an open source library, as the kick package on mpm.
Jeff Terrell: mpm is the node package manager and there's a bunch of javascript packages there Okay, so this very popular package repository for web APP development, as well as mobile Apps and other things as well server side, so this guy Asia has this kick package there.
Jeff Terrell: And it turns out there's a company named kick maybe maybe a company that was formed after a user created this package, maybe not I don't know.
Jeff Terrell: But kick the company decides it wants to use that name for their package, which makes sense, but he was our first he says no, I already had this name this is mine, people are using this it's not yours don't take it away from me.
Jeff Terrell: The company appeals to mpm mpm has a conflict resolution policy.
Jeff Terrell: They try to enforce the principle of least surprise for package ownership and so you can appeal and say no, I really think this game should be mine.
Jeff Terrell: And they win the appeal and then agrees with them, they say yeah okay that makes sense yeah kick the company should have kicked the package and they transfer ownership of that package to that company, despite agers objections.
Jeff Terrell: Users mad.
Jeff Terrell: doesn't like that see retaliates by on publishing all his packages from mpm.
Jeff Terrell: screw you vm and do that to me.
Jeff Terrell: One of those packages turns out those are very popular.
Jeff Terrell: They left that So this was a pocket of Tennessee is downloaded 2 million plus times the previous month.
Jeff Terrell: And it's gone.
Jeff Terrell: No, no, old versions available it's gone he unpublished mpm install starts failing or lots of people everywhere.
Jeff Terrell: there's even.
Jeff Terrell: One of the.
Jeff Terrell: This year.
Jeff Terrell: This includes a bagel js was one of the most popular might have been number one most popular package on in all of them PM at the time it was certainly top 10 and.
Jeff Terrell: It included included a dependency on my credit card, so any package that depended on table and directly depended on left hand and therefore mpm install which is just a basic license all dependencies it's not a difficult like it should never fail.
Jeff Terrell: But it would be yeah.
This.
Is all.
They want included in our package.
Jeff Terrell: Average right right yeah Do you really need a package to determine if.
Jeff Terrell: If something is on or not that's a great point i'm actually going to talk about that as well that's a very good point and left that is one of these bad.
Jeff Terrell: i'll show you the code in a minute it's like 11 lines of code all it does is left left pad a string there's some spaces in front of the string.
Jeff Terrell: And you can read more about this on the blog so here's the source code.
Jeff Terrell: there's not much going on here.
Jeff Terrell: All right, and if you have a lot of trust if you're a great trusting person or maybe you're not mindful about your technology choices and you sort of blindly just bring in more dependencies into your project.
Jeff Terrell: That kind of makes sense that you would depend on something they do this for you, and if somebody's already written the code.
Jeff Terrell: Presumably it's kind of been battle tested other people I figured out vibes and solve those bugs and so instead of having to re encounter all the same bugs and reinvent the wheel, why not just use a realist somebody else's written right.
Jeff Terrell: I think people back in like the 80s were wondering how are people going to stop rewriting code in fact i'll go in a little bit of a historical progression here.
Jeff Terrell: In the early days of computing like the I want to say the 16th i'm not real sharp on my my history, at that point, but with the 16th.
Jeff Terrell: software developers, they would be rewriting all the code that they've already written every time a new machine came out because the new machine would have a different machine language.
Jeff Terrell: So they have to rewrite all those same algorithms all those same functions to do the exact same thing, but now they had to use a different language.
Jeff Terrell: Was that was the state of the art in computing back then and fast forward maybe a generation or so, and people are saying well the machine language is now pretty stable.
Jeff Terrell: But how do we figure out this question of like sharing code and stopping people from wasting so much time always reinventing that wheel.
Jeff Terrell: Somebody already wrote it and is odd function somebody wrote in his prime function, you know, there are good ways of doing this.
Jeff Terrell: Efficient performant ways of doing this we shouldn't be wasting so much of like the global developer time rewriting the same thing, so we need to figure out some way of sharing the code and then at the end does this right.
Jeff Terrell: Somebody wrote a lot of bad function, but it has a package it's a real small thing easy to depend on.
Jeff Terrell: 11 lines of code that you could do yourself, but if you don't have to do it.
Jeff Terrell: So anyway that's that's left bad question.
Jeff Terrell: Depending on the license yeah and I think in this particular case that i'm pretty sure the license was open, like you, are allowed to use it in your.
Jeff Terrell: In your project now a lot of dependencies that are going to depend on are going to be this small.
Jeff Terrell: And it's kind of Nice to just have that tucked away somewhere, so that it's not in view and they're in the repo so most people wouldn't do that.
Jeff Terrell: But, and the other thing is if you're not depending on the package.
Jeff Terrell: Say there's a bug in this code you're never going to know that it was fixed right, but if you see if there's a later version oh there's version 3.1 Point two now I have version 3.1 point one or some sort of bug fix that I can benefit from because i'm links links to that package.
Jeff Terrell: But yeah so maybe in this case, a lot of developers were wishing that instead of depending on how bad they are just copy the source.
Jeff Terrell: That would have certainly solve this, how do you know you never know something like this is going to happen until it does right.
Jeff Terrell: So, again there's there's not really a right answer here, but just being mindful of the choice that you're making you're depending on something that's really, what I want to impress upon you.
Jeff Terrell: Okay, another case study I think this one's even more fun event stream, this is a couple years later, also in the mpm ecosystem javascript.
Jeff Terrell: I believe, is the most popular programming language in the world nowadays.
Jeff Terrell: it's not that it's Java and javascript number two.
Jeff Terrell: All right, there's this package on mpm called event stream.
Jeff Terrell: it's been around since 2011 on by user dominic car 2000 stars used by almost 4000 packages, you know it's a pretty well respected little program or package.
Jeff Terrell: and manages has like some utility functions to process events streams and different things with them it's just not just have some utilities it's something that a lot of people find useful.
Jeff Terrell: Back in July 2015 there's a user github github users devonish proposes adding flat map functionality, I believe this is kind of a functional programming approach.
Jeff Terrell: And dominic the owner says yeah sure you know, if you want to make your PR for that before quest for that you know figure out how to make that work i'll be happy to merge, by the end and bring that into.
Jeff Terrell: What is considered the you know official event stream, you know we're releasing new version and everybody can benefit from that.
Jeff Terrell: This, by the way, is a really common way that open source works if you haven't seen that somebody says hey I could really benefit from this and the package owner will say very reasonably like.
Jeff Terrell: You know I don't want to be implementing you know doing your work for you, but if you want to fork the repo.
Jeff Terrell: And figure out how to make this work for you then send me a pull request and i'll review your changes and merge it in and everybody else would benefit as well, so very, very common exchange.
Jeff Terrell: And, as with any of these exchanges nothing happens for a few years, and this is something eventually did happen, many of these kinds of requests just never actually happen.
Jeff Terrell: But a few years later mpm user Antonio macias creates an rpm package flat maps flat map stream.
Jeff Terrell: Get hub user which maybe is the same person, maybe not not real clear right nine control.
Jeff Terrell: offers to create a PR for event stream to use flat map stream, so this is going back to that original proposal that feminists made and right nine control is saying yeah I can do that we have this new package flat map stream that I can I can use here.
Jeff Terrell: And dominic are the package owner says sure do it, and in fact.
Jeff Terrell: gives this user, the ability to go ahead and cut new versions of event stream I think dominic tar had like 400 packages on mpm at this point, or something like that so he's not.
Jeff Terrell: Probably not super motivated to.
Jeff Terrell: Make it this way he has an interest in.
Jeff Terrell: Not being the bottleneck, for all these different things, and so, if somebody else seems motivated to make some changes and.
Jeff Terrell: Then yeah okay sure i'll give you the keys you just do it that way, I don't have to worry about it and so right now and control actually has the keys to cut a new version of event stream and put it on and pm.
Jeff Terrell: Any implementation.
Jeff Terrell: and various updates to the flat map stream package which remember is the dependency of event stream.
Jeff Terrell: And, most of them are innocuous you can follow along there's some code formatting changes and making the metadata more discoverable and mpm different things like that, but some version oh point 1.1 includes malicious code.
Jeff Terrell: And event stream version 3.3 Point six incorporates flat map stream version oh point 1.1 so now i've been screen 336 has malicious code in it.
Jeff Terrell: Now it gets a little bit more devious the.
Jeff Terrell: The code for this.
Jeff Terrell: unimpeded mill say yeah this code comes from this repository and so usually what you can do is say yeah i'll go to the repository i'll look at the source code if i'm really curious about it.
Jeff Terrell: And i'll look at the tag so if i'm if i'm thinking if the latest version of flat map Stream is O dot one dot one I can go to the repository and look at the tag version oh dot one dot one and look at the source code for that version and just be sure it's not doing anything sketchy.
Jeff Terrell: But.
Jeff Terrell: Right nine controls, a little bit more devious than that right they actually.
Jeff Terrell: Change the tag so they changed the tag on in the repo to point to something that's innocuous doesn't have any malicious code in it at all.
Jeff Terrell: And you would have to be looking at the check sums of the actual you know what was really published in PM as version oh that one that one.
Jeff Terrell: And then, what is the checks on the code that is version oh that one that one on github and you would have to look at the text is to figure out that this is actually different code.
Jeff Terrell: So just looking at the code isn't enough, even if you were actually that diligent which almost nobody ever is.
Jeff Terrell: very nice developers start noticing.
Jeff Terrell: It first nothing, nobody has a lot of suspicion about this, but somebody says like well i'm getting this weird deprecation warning that I don't really understand that has to do with.
Jeff Terrell: A cryptography library like open ssl library or something like that what's up with that and people start looking into it and eventually.
Jeff Terrell: about a month later, towards the end of November of 2013 people desert starting to get on the trail of you know there's something suspicious going on.
Jeff Terrell: What is this library doing and start tracing it down to what what's happening, they start figuring out maybe that the code on github dot one dot one is different than the code that was uploaded in pm.
Jeff Terrell: start looking into it and eventually figure out there is malicious code and platinum stream.
Jeff Terrell: The O dot one at one.
Jeff Terrell: By then, the malicious code was downloaded millions of times.
Jeff Terrell: Maybe just on developer machines which would be tragic enough right you just happen to say mpm install and all of a sudden, you have code that can log all your keystrokes.
Jeff Terrell: Have you bad code that's looking at you know what what sites you go to and sending that to some server and they were trying to blackmail you or something who knows.
Jeff Terrell: But if it's not even just developer machines that are compromised by this its production machines.
Jeff Terrell: These are machines that are running servers that have access to usernames and passwords of users.
Jeff Terrell: Maybe maybe popular websites and all of a sudden this code is there, it could be doing anything pending on what the you know right nine Control decided that should do.
Jeff Terrell: This is this is bad, this is really bad.
Jeff Terrell: Now it turns out, the target of this attack was not to do keystroke logging not to crack production databases and get password information out by the way, different production databases have been compromised as a brief aside.
Jeff Terrell: By then.
Jeff Terrell: pw ATT COM.
Jeff Terrell: Type your email in here.
Jeff Terrell: And it'll tell you, if your email address has been exposed like a password for that email address has been exposed and some production database hack right so.
Jeff Terrell: Where was mine exposed and Canada alright so graphic design tool website camera suffered a data breach and I had an account there, and so the password an email that I use on Canada was exposed.
Jeff Terrell: All right, whatever if I use that same password on canvas I did for my email or for any other service hackers can go try that all the password stuffing attack and they can log in as me.
Right.
Jeff Terrell: So this is actually why use a password manager.
Jeff Terrell: It looks nervous and announcement bit warden is one that I use I like it's cross platform.
Jeff Terrell: works on my phone to you, I have a different password on canvas than I do, on any other site, I have a different password every single site that I use.
Jeff Terrell: they're all just generated a lot of characters and everything, so I haven't actually been phones because i'm i'm using a password manager and using different passwords and have some hygiene around this but um yeah, this is the kind of thing that can happen from event stream.
Jeff Terrell: zoom users can you still hear me I just kind of notification assigned out of zoom.
Jeff Terrell: Somebody just confirm you okay great cool Thank you.
Jeff Terrell: So anyway, this is the kind of thing that might have happened from event stream could have happened from event stream, because the flat map stream if that code had been written so that it would query the production database for usernames and passwords is there a question.
Jeff Terrell: Well, and pencil if you can figure out who it was I don't think they ever found out here, this was worth your.
Jeff Terrell: No, I don't think so I don't think dominant car ever got in trouble for that yeah.
Jeff Terrell: yeah it turns out, they did some analysis of this after the fact, and figured out that the actual target of this flat map stream.
Jeff Terrell: code was a website called kind of had this intermediate took it out.
Jeff Terrell: Kobe.
Jeff Terrell: Kobe was a website that would give you supposedly secure bitcoin wallets cryptocurrency wallets so you can put all your bitcoin.
Jeff Terrell: In copay.
Jeff Terrell: And that way you wouldn't have to manage your own wallet Of course you are trusting propane at that point, right here, depending on and therefore you're trusting them.
Jeff Terrell: And it turns out that this this attack I think what maybe happened was that the attacker recognized that cocaine was depending on event stream.
Jeff Terrell: And found a way to get malicious code into event stream if he could kind of get past the gatekeeper other constraints on a car.
Jeff Terrell: And he did he added some legitimate functionality to event stream that also included some malicious code in that and was able to get that malicious code in co-pays production web server.
Jeff Terrell: The Code was designed to find users who had at least 100 bitcoin and withdraw their their corn.
Jeff Terrell: So that would have been really serious, at least for some users right, you can imagine, different things that could have done it said, you know kept this back door open the whole time.
Jeff Terrell: So again, the point here is well actually we'll just go through some lessons, be careful what you depend on right you're making a.
Jeff Terrell: choice to trust the thing that you depend on.
Jeff Terrell: Of course nobody suspected that event stream would have malicious code and nobody suspected the flat map stream would have malicious code in it, but it did.
Jeff Terrell: Also, sometimes you get what you pay for right, I mean this is all free code out there.
Jeff Terrell: And so you know, nobody is guaranteeing that it's going to be a great product and we're just going to be guaranteeing that it doesn't have security holes it's free they're just putting it out there as a public service.
Jeff Terrell: Even though the name never changed every event stream.
Jeff Terrell: lots of things underneath it.
Jeff Terrell: Right.
Jeff Terrell: That I mean, maybe, if you look at the name and the version number that's usually going to be consistent, but.
Jeff Terrell: You know just there's there's always people underneath these names and maybe the people under a name change or maybe the person who is under the name has had a change of view like ACER did.
Jeff Terrell: Your thing and people.
Jeff Terrell: Also, just you know, remember that open source maintainer are people too, and so check your entitlements don't expect that you're going to get high quality software that they're going to be super responsive to you, they might not respond at all, you might have a request and.
Jeff Terrell: you hear nothing back, and you know you're not paying them there's no reason, they have to respond so.
Jeff Terrell: yeah just check your sense of entitlement there.
Jeff Terrell: And this is kind of coming back to the question that was asked earlier.
Jeff Terrell: If you focus more on libraries and focus especially on simplicity you're going to tend to have this problem is your sort of surface area of risk.
Jeff Terrell: is going to be smaller if you depend on fewer things if every package out there has a one in a million chance of having something like this happen, obviously, your odds of having this happen in your project are going to be a lot greater if you have 10,000 users versus if you have time.
Jeff Terrell: So one example.
Jeff Terrell: frameworks tend to be a lot heavier on defenses because they tend not to be simple.
Jeff Terrell: and create react APP is a popular way popular frameworks out there for react web Apps they will tagline is set up a modern web APP by running one command notice that this prioritises ease doesn't really say anything about simplicity it's it's focusing on the enos of doing this.
Jeff Terrell: I did this this morning and it installed 1038 packages taking them 230 megabytes of disk space on my hard drive.
Jeff Terrell: That was just from the getting started I just said in px create react APP my APP and it did its thing.
Jeff Terrell: A minute later at 1000 packages installed.
Jeff Terrell: So it was really easy simple little copy and paste command into my terminal window, but it wasn't it's not simple.
Jeff Terrell: And who knows you know could one of those 1038 packages, be the next event stream.
Jeff Terrell: I mean i'm not going to go figure that out right is anybody going to go through every single one of these packages and say what about this one, what about this one, no.
Jeff Terrell: Just wait until somebody out there there's really smart starts.
Jeff Terrell: Getting suspicious about something they don't understand and figures out that there's an issue, and maybe by then it's already too late for you.
Jeff Terrell: So i'm making this out to be to sound like a really risky thing I mean again, most people just depend on stuff and it's fine it's always fine until it isn't.
Jeff Terrell: This this sort of standard operating procedure for most projects is just yeah out of dependency whatever, but I just wanted you to be aware of the trade off of that so that you can make conscious choices.
Jeff Terrell: A little bit of humor here.
Jeff Terrell: Have you stopped dicks in the universe.
Jeff Terrell: node modules wins.
Jeff Terrell: that's where the mpm dependencies go like 1038 dependencies that I got from my create Ram.
Jeff Terrell: Okay let's start to pull.
Jeff Terrell: When are you meeting with your client i'd like to narrow this on the website.