NPM single-handedly wasted millions of hours of developer time troubleshooting ridiculous issues and took us back at least 10 years by introducing the whole web cancer and JS dependency hell. Change my mind.
Completely agree, this makes absolutely no sense. Don't CRLs and OCSP exist to invalidate a leaked key? What are we actually solving here?
DANE should already work in theory and does for some applications (PGP), it's the browsers that refuse to implement it.
Because you usually don't want to just toggle a pin but create an actual useful product. So you could either spend weeks or months reinventing the wheel and end up creating your own pin toggling library or use something that exists, has contributions from people smarter than you and is used by thousands of people. You have to pick your battles when using a library vs rolling your own and this is no different than it was back in the days.
Yes, you could with a LOT of manual effort and reinventing wheels. Now you can just write a few 100 lines of yaml and get automatic autoscaling, rolling updates, A/B updates, HA.. The real effort is having the sysadmin capacity and expertise to run your own k8s cluster, which is why cloud vendors make so much $$ selling you a managed one.
You can use it for a dev runtime but that doesn't mean you are building images with every line of code change.. for an interpreted language you can just volume mount to the exact version of insert-your-interpreted-language here.. and yes, most people just do it for for the final deploy.