--- title: The Cathedral and the Catacombs | daily.dev description: A philosophical essay extending the classic 'Cathedral and Bazaar' metaphor by introducing a third element: the 'catacombs' — the transitive dependency graph... canonical: https://daily.dev/posts/the-cathedral-and-the-catacombs-7s3qnwecg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Cathedral and the Catacombs | daily.dev og:description: A philosophical essay extending the classic 'Cathedral and Bazaar' metaphor by introducing a third element: the 'catacombs' — the transitive dependency graph... og:url: https://daily.dev/posts/the-cathedral-and-the-catacombs-7s3qnwecg og:image: https://api.daily.dev/og/posts/7s3QnwECg.png og:image:alt: The Cathedral and the Catacombs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Cathedral and the Catacombs **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 5 min read · 28 upvotes · 0 comments ## Summary A philosophical essay extending the classic 'Cathedral and Bazaar' metaphor by introducing a third element: the 'catacombs' — the transitive dependency graph that underlies all software projects regardless of their governance model. The author argues that while decades of discourse have focused on how software is built (cathedral vs. bazaar), almost no attention is paid to the unmapped, unaudited network of transitive dependencies that every project rests on. Drawing on real-world supply chain attacks like the xz backdoor and the event-stream incident, the piece makes the case that this dependency graph is load-bearing infrastructure that nobody designed as a whole, nobody audits holistically, and which represents a structural security risk independent of how well-governed the project above it is. AI coding agents are noted to worsen the problem by pulling in dependencies even more aggressively. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The Cathedral, the Bazaar, and the Winchester Mystery House](https://daily.dev/posts/the-cathedral-the-bazaar-and-the-winchester-mystery-house-x9iqzjdvw) · Hacker News · 1 upvotes · 0 comments - [The Cathedral, the Megachurch, and the Bazaar](https://daily.dev/posts/the-cathedral-the-megachurch-and-the-bazaar-rr8vo8fag) · Hacker News · 2 upvotes · 0 comments - [The Tower Keeps Rising](https://daily.dev/posts/the-tower-keeps-rising-x0acto1pm) · Armin Ronacher · 0 upvotes · 0 comments - [The anatomy of a dependency graph](https://daily.dev/posts/the-anatomy-of-a-dependency-graph-hiqsxunn5) · Planet Haskell · 0 upvotes · 0 comments - [Your Dependency Graph Is a Liability You Haven’t Priced Yet – shipping bytes](https://daily.dev/posts/your-dependency-graph-is-a-liability-you-haven-t-priced-yet-shipping-bytes-jp6exhwi5) · shipping bytes · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#architecture](https://daily.dev/tags/architecture), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/the-cathedral-and-the-catacombs-7s3qnwecg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Cathedral and the Catacombs","url":"https://daily.dev/posts/the-cathedral-and-the-catacombs-7s3qnwecg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-cathedral-and-the-catacombs-7s3qnwecg"},"datePublished":"2026-04-06T10:42:26.937Z","dateModified":"2026-04-06T10:42:51.060Z","description":"A philosophical essay extending the classic 'Cathedral and Bazaar' metaphor by introducing a third element: the 'catacombs' — the transitive dependency graph...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-cathedral-and-the-catacombs-7s3qnwecg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":28},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,architecture,npm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"The Cathedral and the Catacombs"}]} ```