5 ms·

Other programming ecosystems have solved these problems without these glaring problems, so I don't understand why you're acting as though this is unsolvable whi

Other programming ecosystems have solved these problems without these glaring problems, so I don't understand why you're acting as though this is unsolvable while requiring lots of money.

notjack 9y ago
Other programming ecosystems are at least an order of magnitude smaller and not intrinsically tied to technology that's in relatively extreme flux with a massive amount of users (browsers).
- nl 9y ago
  least an order of magnitude smaller No they aren't. It's true that NPM is the biggest package repository by some way, but it's only ~2x the count of the Maven repository (492135 vs 194954). PHP and Ruby also have the same order of magnitude. tied to technology that's in relatively extreme flux with a massive amount of users Maven/Java has similar challenges to some extent with both Android and server side development being extremely common in the same language. The large number of users and the extreme technology flux is also similar.
raggi 9y ago
Name one.
- thehardsphere 9y ago
  Java/Maven.
  - raggi 9y ago
    So you use https://github.com/whispersystems/gradle-witness https://github.com/whispersystems/gradle-witness, and you manually verify everything you whitelist right? And you never typo, right?
    - orf 9y ago
      I doubt he does, but i also doubt that installing a framework via maven brings in 1,000 implicit dependencies from 1,000 untrusted authors, unlike in JS land. Edit: react, webpack, babel, babel-preset-env bring in 1,257 dependencies. Try vetting all those by hand.
      - thehardsphere 9y ago
        I think my (primarily Java) project at work brings in about 50-100 external dependencies. That includes some ridiculously large frameworks, like Spring. Honestly, I don't know because I don't have dependency problems. You know how hard it would be for me to vet the dependency if I did have a dependency problem? "mvn dependency:tree > deps.txt." It would take half the day, but I could vet them all. I also have a Django project on the side. It has 8 dependencies. I have vetted all of them very carefully. It's smaller than the work project, but that's not the reason why it has fewer dependencies than a typical JS mess. It has fewer dependencies, because Pythonistas have a philosophy and cultural practices that produces quality software with lots of functionality included.
        raggi 9y ago
        Npm being split means more metadata, not necessarily more code. You admit to not reading your code or inspecting your dep, and you assert that you have no problems - based on what? Your deps.txt is barely different than a lock file here. Reading the code from dependencies is not really hard anywhere here.
        thehardsphere 9y ago
        > you assert that you have no problems - based on what? The software works as intended and I know that my dependencies have not changed without me explictly changing them. > Your deps.txt is barely different than a lock file here. That command produces a tree of all dependencies and their dependencies. I don't know what that has to do with a lock file.
    - 9y ago

Other programming ecosystems have solved these problems without these glaring problems, so I don't understand why you're acting as though this is unsolvable while requiring lots of money.

notjack 9y ago

Other programming ecosystems are at least an order of magnitude smaller and not intrinsically tied to technology that's in relatively extreme flux with a massive amount of users (browsers).

nl 9y ago
least an order of magnitude smaller No they aren't. It's true that NPM is the biggest package repository by some way, but it's only ~2x the count of the Maven repository (492135 vs 194954). PHP and Ruby also have the same order of magnitude. tied to technology that's in relatively extreme flux with a massive amount of users Maven/Java has similar challenges to some extent with both Android and server side development being extremely common in the same language. The large number of users and the extreme technology flux is also similar.

raggi 9y ago

Name one.

thehardsphere 9y ago
Java/Maven.
- raggi 9y ago
  So you use https://github.com/whispersystems/gradle-witness https://github.com/whispersystems/gradle-witness, and you manually verify everything you whitelist right? And you never typo, right?
  - orf 9y ago
    I doubt he does, but i also doubt that installing a framework via maven brings in 1,000 implicit dependencies from 1,000 untrusted authors, unlike in JS land. Edit: react, webpack, babel, babel-preset-env bring in 1,257 dependencies. Try vetting all those by hand.
    - thehardsphere 9y ago
      I think my (primarily Java) project at work brings in about 50-100 external dependencies. That includes some ridiculously large frameworks, like Spring. Honestly, I don't know because I don't have dependency problems. You know how hard it would be for me to vet the dependency if I did have a dependency problem? "mvn dependency:tree > deps.txt." It would take half the day, but I could vet them all. I also have a Django project on the side. It has 8 dependencies. I have vetted all of them very carefully. It's smaller than the work project, but that's not the reason why it has fewer dependencies than a typical JS mess. It has fewer dependencies, because Pythonistas have a philosophy and cultural practices that produces quality software with lots of functionality included.
      - raggi 9y ago
        Npm being split means more metadata, not necessarily more code. You admit to not reading your code or inspecting your dep, and you assert that you have no problems - based on what? Your deps.txt is barely different than a lock file here. Reading the code from dependencies is not really hard anywhere here.
        thehardsphere 9y ago
        > you assert that you have no problems - based on what? The software works as intended and I know that my dependencies have not changed without me explictly changing them. > Your deps.txt is barely different than a lock file here. That command produces a tree of all dependencies and their dependencies. I don't know what that has to do with a lock file.
  - 9y ago