This morning I tried running "brew update". It fetched Git repositories then stalled without hints about the cause. After too much debugging time, I discovered that it was running my fake gpg which blocked waiting for input. I deleted fake gpg then "brew update" proceeded fine.
Too much sharingThe wasted debug time was clearly my fault, but it reminded me how dangerous sharing is. Too much of our software is a wobbly tower of dependencies. Sure, you can change the bottom block, but it's risky.
The well-known costs of global mutable state are a symptom of problematic sharing. Package management becomes NP-complete dependency hell when sharing is mandatory (assumption 4). The recent Cloudbleed vulnerability was mostly a problem because of sharing:
Because Cloudflare operates a large, shared infrastructure, an HTTP request to a Cloudflare web site that was vulnerable to this problem could reveal information about an unrelated other Cloudflare site. (emphasis added)
In other words, FitBit and Uber have a security vulnerability because some random WordPress blog generated bad HTML.
Don't share, copySome cultures don't like to share. Docker containers isolate applications from each other. Node prefers to load a module that's the least shared. OpenBSD doesn't like to share file system partitions. Chrome sandboxes each site to prevent sharing. This is pretty nice. If my Youtube tab has a problem, I don't have to consider debugging the Reddit tab. If I upgrade one project's Node dependency, it doesn't break other Node projects.
Some cultures that used to favor sharing are moving away from it. Perl (local::lib) and Go (vendor directories) come to mind. Of course, everyone can still share (in the sense of using identical code), they just get their own local copy of it. Go's default of building static binaries is a breath of fresh air.
All of this is just a reminder to me: if my code shares anything, find a way to make it either local (not shared) or immutable.