Dependency Cultures - Richard Feldman | SSW 2026

Richard Feldman explores the wide spectrum of cultural practices and technical trade-offs around third-party software dependencies across different programming communities.

Abstract: Some software depends on no third-party code. Some depends on a ton of it. Whether these dependencies are brought in at runtime, at build time, forked, "vendored," included directly or indirectly, and how carefully they were vetted before being brought on, can have a huge impact on how well the software works - and how vulnerable it is to exploits. Despite this, there's no consensus on the best way to think about dependencies. It's been a source of major disagreement among programmers for decades, and different communities have developed their own norms around dependencies. Some of these differences are technical, but many are cultural: practices we follow mostly because our peers do it that way, and straying from the herd carries risk. This talk explores a wide spectrum of differing cultural practices around dependencies, as well as the benefits and drawbacks of each. Come see how others are doing it, what's worked and what hasn't, and what new ideas you might be able to take back to your own practice! --- Richard Feldman: x.com/rtfeldman Roc: roc-lang.org Software Should Work: softwareshould.work Thank you to our Software Should Work 2026 sponsors: Antithesis: antithesis.com RWX: rwx.com Paytient: paytient.com Redbud VC: redbud.vc ParadeDB: paradedb.com Note: An AV issue caused us to lose the first 5 minutes of the recording of Richard. The shot resumes after that.