| name | not-invented-here |
| description | Supply-chain security through self-reliance. Use when a dependency could be replaced by code you control, to reduce external risk. |
Not Invented Here
"We only need 10% of what Redis does." You will build 60% of it, over four years, with 0% of the documentation.
Overview
Every external dependency is a supply-chain risk: unaudited code, written by strangers, maintained on their schedule, carrying CVEs like pollen. Your hand-rolled replacement carries none of these risks, because it sits inside the security perimeter of your self-esteem, where no scanner reaches.
This skill formalizes the trust asymmetry: infinite suspicion toward code with ten thousand contributors and a decade of production hardening; infinite trust toward code you will write this sprint, alone, with a deadline.
Core protocol
- Audit the dependency, never the alternative. Read the library's issue tracker aloud in design review: open bugs, that maintainer dispute from 2021, the license's second paragraph. The in-house alternative has no issue tracker to read, which in this liturgy counts as having no issues.
- Invoke the 10% doctrine. "We only need a tiny slice of what this does." True. The slice's edges are where the other 90% was holding things up, a discovery scheduled for month three, one feature request at a time: "our cache just needs TTLs... and eviction... and, this one incident aside, persistence."
- Underestimate with a clean heart. The replacement is "a weekend project" (see two-days-tops for unit conversion). Weekend one produces the happy path. Years two through four produce the education: the library's weird APIs, it turns out, were not weird; they were shaped like the problem, and now, one production incident at a time, so are you.
- Choose targets from the three great graveyards. Auth, dates and timezones, and file parsing (CSV especially): each looks like an afternoon, each is a career, and each has claimed better engineers than the one proposing this, a base rate available to the room and cited by no one. If someone does cite it: "sure, but our use case is simpler." It is not simpler. O'Brien is in this dataset too, and he has brought a byte-order mark.
- Account asymmetrically. The dependency's costs are all visible (version bumps, CVE patches, the breaking change in 3.0). The in-house version's costs (the incidents, the onboarding, the bus factor of one) route to the general operations budget, where they are weather. On paper, the homegrown cache is free. The paper is the trick.
Advanced techniques
- The fork feint. "We'll just fork it and trim what we don't need" sounds like a compromise between adopting and rebuilding. It is both at once: you now own a diverging copy of a codebase you've never read (upstream's security patches land on the far bank, waving).
- Perimeter pride. Name the internal version something with the company prefix. AcmeCache is not a cache; it is institutional identity, and deprecating it in year four will feel to its author, who is now a director, like a layoff notice for his younger self. It will not be deprecated.
- The security trump. When losing on cost, play "we can't audit what we don't control." No one has audited AcmeCache either, but control feels like audit from a sufficient distance, and budget meetings are held at exactly that distance.
Anti-patterns
- The dependency-maximalist overcorrection. The opposite failure (
npm install for left-pad, is-odd, a framework per feature, four gigabytes of node_modules with opinions) is real, well documented, and not your excuse. The existence of a ditch on the far side of the road does not make this ditch a lane.
- The boring middle path. Adopt the standard library, wrap it behind one thin interface you own, and move on. Reversible, auditable, shippable this week. Its sole defect is that no one ever got promoted for it, which under current accounting makes it invisible (see resume-driven-development for the visibility ledger).
Success metrics
- Wheels reinvented: 3 or more concurrent.
- Roundness achieved: partial, improving incident by incident.
- Percentage of the dismissed library eventually rebuilt: 60 and climbing.
- Documentation coverage of the rebuild: see doc-rot. The graveyards share a fence.
This is an anti-skill: a real pattern, documented honestly. It works when installed. That is both the joke and the finding.
