3 ms·
There are two main factors that you're ignoring: The first is that every added dependency creates ongoing cost, and that in a world where it becomes typical fo
by pgpkkg 11y ago
There are two main factors that you're ignoring:
The first is that every added dependency creates ongoing cost, and that in a world where it becomes typical for a single application to have hundreds of dependencies, this cost is non-trivial and is, at minimum, worth considering.
The second is that even before the left-pad fiasco, a lot of experienced individuals (myself included) believed that npm is fragile by design; and that the dependency situation means that if you want to avoid nasty surprises, you need to pin every version of every dependency and you need to keep your own local copies of all of the files in case something like this happens.
Overall, you're accusing others of failing to fully understand the situation and of being condescending and rude; but you're doing it in a way that is condescending and rude, and that fails to fully understand the situation. Responses like yours are completely unhelpful. They do not change hearts or minds. They do not help npm fix their problems. And your caricature of those who find the situation funny is so distorted from reality that nobody will see themselves in it.
The fact that your post is top of HN is just more evidence that Hacker News is no longer a useful website. It's kind of funny, YC gets better every year, but HN gets worse. I wonder at what point Sam and pg will realize that this cesspool is actually hurting their brand.
- andy_ppp 11y ago>>> a lot of experienced individuals (myself included) believed that npm is fragile by design I agree with you! >>> you're accusing others of failing to fully understand the situation and of being condescending and rude I'm saying that people who say "massive helpers.js file yo" is not a solution. Improve the standard lib, npm and use lodash. I'm also saying we all rely on other package managers so don't think just because you saw npm as flawed you get a free ride to say this couldn't happen with other systems. All of them have various ways of poking holes in any security you think they have. At some point you have to put trust in your package manager. I'm riling against the people saying to copy and paste code everywhere. >>> The fact that your post is top of HN is just more evidence that Hacker News is no longer a useful website. It's kind of funny, YC gets better every year, but HN gets worse. I wonder at what point Sam and pg will realize that this cesspool is actually hurting their brand. Disagree sure, but I think to say that my post is from a cesspool is a bit over the top!