The pain of dependency management

Baruch Sadogursky (Chief Sticker Officer at JFrog) joins Natalie & Johnny to lament the current state of dependency management in Go and other languages. They discuss the problems dependency managers face, possible technical mitigations like SBOMs, people problems that will never be solved by tech, and take questions from listeners in the #gotimefm channel of Gophers Slack.

Discuss on Changelog News

Changelog++ members save 4 minutes on this episode because they made the ads disappear. Join today!

Sponsors

• Square – Develop on the platform that sellers trust. There is a massive opportunity for developers to support Square sellers by building apps for today’s business needs. Learn more at changelog.com/square to dive into the docs, APIs, SDKs and to create your Square Developer account — tell them Changelog sent you.
• Honeycomb – Guess less, know more. When production is running slow, it’s hard to know where problems originate: is it your application code, users, or the underlying systems? With Honeycomb you get a fast, unified, and clear understanding of the one thing driving your business: production. Join the swarm and try Honeycomb free today at honeycomb.io/changelog
• Ship It! – A podcast about getting your best ideas into the world and seeing what happens. Listen to an episode that interests you and subscribe today.

Featuring

• Baruch Sadogursky – Twitter, GitHub
• Natalie Pistunovich – Twitter, GitHub
• Johnny Boursiquot – Twitter, GitHub, Website

Notes and Links

• Sam Boyer saying dependency managers being a human problem
• Pyrsia.io untemperable ledger for modules
• PGP Keys

Something missing or broken? PRs welcome!

Episode source