3 ms·

Asking for Immutable / Append-only is insanity, due to the fact that eventually someone WILL clutter the hell out of it, which all of your mirrors will hate you

Asking for Immutable / Append-only is insanity, due to the fact that eventually someone WILL clutter the hell out of it, which all of your mirrors will hate you for, as well as downstream ecosystem toolchains. The only viable way to allow it is by vetting every upload, and uh, good luck finding volunteers for that. Decentralized / Distributed is a good thing to have and prior art already exists. Source: Experience with the grand daddy CPAN.

mateuszf 11y ago
Immutability doesn't mean you need to have the whole history locally. For example in git you can just checkout one branch while the whole repo is on the server. For bitcoin there are clients which download only a part of the blockchain even when every transaction is immutable and cryptograpically signed.
thejosh 11y ago
Vetting new module is what the drupal.org project does, and the backlog is massive and people don't want to submit new projects due to new module hell. After their first module they can create as many new modules aas they want though.
- ohthehugemanate 11y ago
  Worth noting too, that there is a strong community movement AWAY from the thorough vetting process and TOWARDS an unvetted, open system modeled after npm et al.
jkot 11y ago
Maven Central (java) is like that. So far not much problems.
thresh 11y ago
> The only viable way to allow it is by vetting every upload, and uh, good luck finding volunteers for that. Debian seems to have no problems with that.
- lisivka 11y ago
  Why parrent comment was downvoted? Major Linux distributions (Fedora/Debian/SuSE/etc.) are excellent example of proper solution for the "dependency hell" problem for C programs. JavaScript is the new C, but for web, so same solution will appear for same problem.
- nyan4 11y ago
  > Debian seems to have no problems with that. Because Debian developers do not package all sort of crap.
- pjc50 11y ago
  Debian vets the hell out of the developers, but once you're a dev you can update any package. It's a major faux pax to push an update to a package that you're not responsible for without a very good reason, but since they're all signed with the uploader's public keys this isn't a problem.
- bpchaps 11y ago
  Yeah, no. This is 90% of the reason why I stopped using Debian based distros. There's a complete lack of consistency with how they do their package management to the point that I eventually started to build most things from source. Too many outdated and unpatched packages. Archlinux is a bit better, but the crazy amount of timeouts and the everything-goes mentality is getting pretty frustrating. CentOS/rhel isn't much better, for what it's worth. Dear god, those repos....
chadly 11y ago
It is not insanity. It is actually what many sane package managers do. Allowing someone to "unpublish" something that many depend on - that is insanity.

mateuszf 11y ago

Immutability doesn't mean you need to have the whole history locally. For example in git you can just checkout one branch while the whole repo is on the server. For bitcoin there are clients which download only a part of the blockchain even when every transaction is immutable and cryptograpically signed.

thejosh 11y ago

Vetting new module is what the drupal.org project does, and the backlog is massive and people don't want to submit new projects due to new module hell. After their first module they can create as many new modules aas they want though.

ohthehugemanate 11y ago
Worth noting too, that there is a strong community movement AWAY from the thorough vetting process and TOWARDS an unvetted, open system modeled after npm et al.

jkot 11y ago

Maven Central (java) is like that. So far not much problems.

thresh 11y ago

> The only viable way to allow it is by vetting every upload, and uh, good luck finding volunteers for that. Debian seems to have no problems with that.

lisivka 11y ago
Why parrent comment was downvoted? Major Linux distributions (Fedora/Debian/SuSE/etc.) are excellent example of proper solution for the "dependency hell" problem for C programs. JavaScript is the new C, but for web, so same solution will appear for same problem.
nyan4 11y ago
> Debian seems to have no problems with that. Because Debian developers do not package all sort of crap.
pjc50 11y ago
Debian vets the hell out of the developers, but once you're a dev you can update any package. It's a major faux pax to push an update to a package that you're not responsible for without a very good reason, but since they're all signed with the uploader's public keys this isn't a problem.
bpchaps 11y ago
Yeah, no. This is 90% of the reason why I stopped using Debian based distros. There's a complete lack of consistency with how they do their package management to the point that I eventually started to build most things from source. Too many outdated and unpatched packages. Archlinux is a bit better, but the crazy amount of timeouts and the everything-goes mentality is getting pretty frustrating. CentOS/rhel isn't much better, for what it's worth. Dear god, those repos....

chadly 11y ago

It is not insanity. It is actually what many sane package managers do. Allowing someone to "unpublish" something that many depend on - that is insanity.