Hacker News Reader

Comment by tunaoftheland | Hacker News Reader

Maybe a Clojure equivalent to NPM's "devDependencies" can manage something like this, so that it gets excluded from the final deployment JAR. It's been a while since I'd done Java/JVM development, but the dev-time vs. deploy-time dependencies configuration should be possible, I would think.

View on HN

I wouldn't want to risk something this critical being in my project. I'm stupid so I try and limit my own attack surface against myself.

A very humble approach, and one that I try to subscribe to, as well. :)

I think the embedding part is certainly a tradeoff. Once the development community settles on a best-practice for things like this, it becomes less of a danger of forgetting. For example, once this sort of config shows up by default in archetypes and boilerplate projects, I feel that the danger is reduced to the level of being manageable. And hopefully the port that the editor uses is blocked by default in the production environment. :)

Yea it seems like a great project but I don't really like to think of my IDE as a dependency of my code but rather my code as a dependency of my IDE.

The pom dependencies allow for `:scope "test"` if that's your bag. You could also wrap the :dependencies inside a special development build task (in Boot) if you choose.

Using leiningen you can add environmental build deps. I forget the specifics but it's definitely available.

Leiningen makes this easy. During development, the :dev profile is run (joined with the project definition), but it's excluded from builds (JAR, WAR, etc.).

Lein and Boot both support tooling plug-ins, ie. libraries that are only loaded as part of the dev environment, so it's certainly possible.

Reply on news.ycombinator.com