Someone else's code

Think of it when you or an agent add a library, or an update to a library you use arrives.

In everyday life

A bakery buys its flour instead of milling it. If the mill changes the blend without notice, the bread changes too. A bakery that orders one named blend, and tests a new blend before it switches, avoids that surprise.

One case

A school’s grade portal uses a free library to format dates. Its settings accept any newer version, and it keeps no lock fileA file that records the exact version of every library a project uses, so every install gets the same code.. The portal rebuilds every hour. At 16:50 on a Friday the library’s author publishes version 2.4.0, which has a bug. From the 17:00 build on, every page with a date shows an error, and nobody at the school changed a line.

A new library version broke a portal that did not change
The case, cell by cell1 cell = 1 hourly build
Library version the portal was tested with
2.3.12.3.12.3.12.3.12.3.1
Library version the build installed
2.3.12.3.12.4.02.4.02.4.0
Broken builds
3
Lines the school changed
0
The settings accepted any newer version and no lock file pinned one, so the 17:00 build picked up the bug.

Every case

Almost every program stands on code written by strangers: dozens or hundreds of libraries, plus the libraries those libraries use. Each one can change, break, be abandoned or carry a security hole. You get its work for free, and you also take on its risk. Teams control this risk in three ways: they record exact versions in a lock file, they update on purpose, and they read what changed.

The word

Engineers call this

dependencyCode your project uses but did not write, usually a libraryA package of code that someone else wrote and published for others to use, such as code that formats dates. downloaded from the internet. It saves you work, and its bugs, updates and security holes become yours too.

Treat every library you add as code you now own. Pin exact versions, update on purpose, and add a library only when it saves more than it costs.

Where this idea leads

Skills that encode it

  • blast-radius pstackReads the source of the library you call and checks its pinned version and any local patch before trusting a change.
  • principle-subtract-before-you-add pstackDefault to subtraction and design for observed usage, so a one-line job does not bring in a whole library.