Hacker News Reader

Why would you want DB drivers and S3 clients in your runtime? That’s exactly what 3rd parties are for, you don’t want to have to update your runtime for a new version of your drivers

View on HN

And a bug in a dependency you can fix easily. One in the runtime is much harder to fix and you then must compile new versions.

And a supply chain attack is much easier with too many dependencies as well.

Every approach has its pros and cons. OTOH the less you rely on third party deps, the less attack surface.

Reply on news.ycombinator.com