4 ms·

I agree that there is a definite cost of dependencies. I don't agree with the implication that these small modules are frivolous - doing one thing and doing it

I agree that there is a definite cost of dependencies. I don't agree with the implication that these small modules are frivolous - doing one thing and doing it well is a time honored Unix principle. It saves developers from having to roll their own dependency, and gives them free wins if the package is well maintained and widely used. Edge cases are often identified and accounted for, even if the responsibility of the package is tiny. The example you gave was a poor choice - read further down https://github.com/sindresorhus/user-home#why-not-just-use-the-os-home-module https://github.com/sindresorhus/user-home#why-not-just-use-t.... It exists to avoid exactly the problem that sparked the conversation around npm today.

msbarnett 11y ago
We disagree on the utility of adding an entire dependency for simple rename of os-homedir. But there are myriad other equally ridiculous packages. is-positive, for instance: https://github.com/kevva/is-positive https://github.com/kevva/is-positive. Abstractions are good when they hide and generalize complexity. These modules merely conceal mundanity. > Edge cases are often identified and accounted for, even if the responsibility of the package is tiny. In my observation, the opposite is true -- most of these trivial packages punt on edge cases. is-positive makes no attempt to handle any. https://www.npmjs.com/package/average https://www.npmjs.com/package/average implements an utterly naive calculation of an array's mean that is numerically unstable in the presence of JS's everything-is-a-float semantics. Hiding tiny, naive implementations behind dependency imports actively harms understanding of the implementation details and failure modes of the code being relied on, in addition to making your build much more fragile by encouraging you to rely on external dependencies that can and will vanish from the Internet at inconvenient times. It's a bad trade-off from every angle. Edit: this blog post (currently on the front page!) does a really good job of capturing my utter bafflement at how completely crazy the node community has gone with this nonsense http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-program/ http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how... Edit 2: and none of this even touches on the complete insanity that is npm running arbitrary code in each dependency at install time. Having 2,000 one-liner trivial dependencies amounts to inviting 2,000 strangers to run arbitrary code on your build server. The node.js community appears to be a pack of complete amateurs.

msbarnett 11y ago

We disagree on the utility of adding an entire dependency for simple rename of os-homedir. But there are myriad other equally ridiculous packages. is-positive, for instance: https://github.com/kevva/is-positive https://github.com/kevva/is-positive. Abstractions are good when they hide and generalize complexity. These modules merely conceal mundanity. > Edge cases are often identified and accounted for, even if the responsibility of the package is tiny. In my observation, the opposite is true -- most of these trivial packages punt on edge cases. is-positive makes no attempt to handle any. https://www.npmjs.com/package/average https://www.npmjs.com/package/average implements an utterly naive calculation of an array's mean that is numerically unstable in the presence of JS's everything-is-a-float semantics. Hiding tiny, naive implementations behind dependency imports actively harms understanding of the implementation details and failure modes of the code being relied on, in addition to making your build much more fragile by encouraging you to rely on external dependencies that can and will vanish from the Internet at inconvenient times. It's a bad trade-off from every angle. Edit: this blog post (currently on the front page!) does a really good job of capturing my utter bafflement at how completely crazy the node community has gone with this nonsense http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-program/ http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how... Edit 2: and none of this even touches on the complete insanity that is npm running arbitrary code in each dependency at install time. Having 2,000 one-liner trivial dependencies amounts to inviting 2,000 strangers to run arbitrary code on your build server. The node.js community appears to be a pack of complete amateurs.