Dora (not not that one) is an attempt by the EU to reduce risk in the financial industry from IT systems.
This follows other transformational legislation such as S-Ox (which does not even mention IT) and GDPR (no you do not need to ask permission for required cookies, 3rd party cookie can’t be required…)
It mandates required practices and reporting of incidents to regulators. The aim is laudable but the act itself is clumsy. It has been written by lawyers without a deep understanding of technology. No developer would have called it DORA!
However it does contain some good concepts:
You must have a robust process for incidents and major ones require reporting to regulators.
You must back up all critical data.
You must understand your own systems.
You must perform security analysis and manage updating of known issues.
The specific one that I want to discuss is the no deprecated libraries.
Introducing this can be problematic especially in the Javascript/Typescript ecosystem.
Javascript has very fine grained packages and each has dependencies on others. Looking at the react starter kit once I found 10k packages! Given that number you are almost guarenteed to find one that has been deprecated/upgraded in any week.
This gets worse when you find packages that need to be aligned, but don’t raise warnings when they get out of step.
Typescript also provides the illusion of type safety. This means you need to convince the compiler that everything is fine, yet at runtime it may still explode.
One safe option is if the library is redundant. Deletion is a good option.
Some items require another library to be upgraded as a plugin is now no longer needed.
The complex one I am working on is an internal code generation compiler. The next version of the compiler does not need the typescript helper tool. The downside is that the tool has been rewritten across the major upgrade and includes breaking changes and external dependency upgrades.
It may be worth having a “not a problem” list for certain deprecations. That has to count as managed.