4 ms·

"But there is actual value in doing things the npm/unix way." This is where the node community falls down. They think because there is value in sometimes doing

"But there is actual value in doing things the npm/unix way." This is where the node community falls down. They think because there is value in sometimes doing it this way, there is always value in doing it this way. Rarely is the right answer for architecture/programming/etc at one of the extremes.

hugozap 11y ago
Composing from small modules has worked great so far. Yeah, npm had a flaw, but people are mixing modularity with a package distribution issue.
- DannyBee 11y ago
  What about the last 16 javascript software engineering fads? What happened to those?
pcwalton 11y ago
The left-pad debacle is not an indictment of small dependencies. The problem would have still happened even if left-pad were a 10,000-line dependency, if that 10,000-line left-pad was as popular as the 10-line left-pad was. The issue was that authors in the npm ecosystem could pull their packages and cause havoc. Copying code is a partial workaround for this problem for small dependencies only, but the problem should be solved at the npm level--and once it's solved there, the virtues of copying code go away.
- DannyBee 11y ago
  I don't buy your argument that "the virtues of copying code go away" in any way, shape or form. It seems somewhat arrogant to me to think that people have spend decades on software engineering approaches to these kinds of issues, but y'all think "yeah, we solved that, no problem!". But I'm not going to argue this further. I guess time will tell.
  - pcwalton 11y ago
    This doesn't seem responsive to my argument at all. I'm speaking from experience with a package manager that was specifically designed up front to avoid the left-pad issue (before left-pad even was a thing). In that environment, dependencies, even small ones, are great. With an overrides feature and lockfiles, you get all the benefit of copying code (ability to hack on it, responsibility for updates, reproducible builds) without the hassles of copying code and trying to stay in sync with upstream. Copying code isn't something you have to spend decades to invent. Rather, I see it as giving up on proper package management. There are coherent arguments that package managers aren't worth it (though I disagree with them), but I don't agree that it's arrogant to try to build package managers that scale up and down, any more than any attempt to use software to solve an engineering problem is arrogant.

hugozap 11y ago

Composing from small modules has worked great so far. Yeah, npm had a flaw, but people are mixing modularity with a package distribution issue.

DannyBee 11y ago
What about the last 16 javascript software engineering fads? What happened to those?

pcwalton 11y ago

The left-pad debacle is not an indictment of small dependencies. The problem would have still happened even if left-pad were a 10,000-line dependency, if that 10,000-line left-pad was as popular as the 10-line left-pad was. The issue was that authors in the npm ecosystem could pull their packages and cause havoc. Copying code is a partial workaround for this problem for small dependencies only, but the problem should be solved at the npm level--and once it's solved there, the virtues of copying code go away.

DannyBee 11y ago
I don't buy your argument that "the virtues of copying code go away" in any way, shape or form. It seems somewhat arrogant to me to think that people have spend decades on software engineering approaches to these kinds of issues, but y'all think "yeah, we solved that, no problem!". But I'm not going to argue this further. I guess time will tell.
- pcwalton 11y ago
  This doesn't seem responsive to my argument at all. I'm speaking from experience with a package manager that was specifically designed up front to avoid the left-pad issue (before left-pad even was a thing). In that environment, dependencies, even small ones, are great. With an overrides feature and lockfiles, you get all the benefit of copying code (ability to hack on it, responsibility for updates, reproducible builds) without the hassles of copying code and trying to stay in sync with upstream. Copying code isn't something you have to spend decades to invent. Rather, I see it as giving up on proper package management. There are coherent arguments that package managers aren't worth it (though I disagree with them), but I don't agree that it's arrogant to try to build package managers that scale up and down, any more than any attempt to use software to solve an engineering problem is arrogant.