3 ms·

The happenings in the Node.js community such as forks are a positive and good thing. They let people experiment with things in a new environment. A lot of good

by inglor 9y ago

The happenings in the Node.js community such as forks are a positive and good thing. They let people experiment with things in a new environment. A lot of good came from io.js (modern V8, promise integration etc). Ayo are working on interesting stuff like shared-memory workers for CPU intensive stuff. The left-pad thing was indeed strange, but it could have equally happened with most package manager - and NPM improved for it. Newbies being excited about something is the hallmark of a popular platform. Node.js feels like this as it graduated from a "fun project" to a popular web platform. I think most stacks have competent and incompetent developers - making Node.js accessible is a good thing, even if it means there are more new people. At the Node.js project we're really fine with those and some "newbies" turned out to be pretty great programmers. full disclosure: I am a Node.js collaborator.

deleted 9y ago
[deleted]
reificator 9y ago
The left pad thing could have happened somewhere else, true enough. But it was far more likely to happen in Node than anywhere else, for the following two reasons: 1.) Javascript has a tiny stdlib relative to other languages that are also used for "real work". I make that distinction just to rule out LOLCode/etc.... 2.) NPM makes it so damn easy to add dependencies, both for finished products as well as component packages themselves. #2 came about because of #1, and is honestly the only way that Node could have gained traction. So while it's NPM's fault you can't really blame them for making that choice. A month or two ago I wanted to add a single NPM dependency to a project at work. I knew it built on top of other packages, but when I installed it I ended up somewhere between 690 and 700 dependencies. From typing `npm install {one-specific-package}`.
- thehardsphere 9y ago
  More crucially to your point 2, NPM allowed people to remove packages once they've been released, and for others to release packages with the identical name as a previously-existing package. I'm not aware of any other package managers that exhibit this rather dangerous behavior.
  - deleted 9y ago
    [deleted]
  - reificator 9y ago
    Yeah, I did leave that bit out, because that's an implementation detail that I believe they have since resolved. It was a massive mistake, but one that could have been avoided and has since been patched. #1 and #2 are foundational to providing Javascript on the server. You could do without #2, but because of #1 it means you'll have a harder time attracting and maintaining a userbase if you don't do it that way. This leaves you vulnerable in the long run IMO.
    - kbenson 9y ago
      > but one that could have been avoided and has since been patched. It would be really nice if many newer languages didn't act like they existed in a vacuum and no prior art existed. Package management was by no means new at the point NPM was being developed, and if they didn't have enough people with experience with the nasty edge cases package managers in other languages had discovered, it would have been trivial to solicit advice from the architects of the package systems for other languages. If there's one thing software engineers love, it's talking about crazy situations where nobody considered this weird edge case and how they had to scramble to fix it (I know I do). I think we've thankfully gotten to a spot where there's enough users and developers of modern programming languages with experience in other languages that we're seeing good cross-pollination at the language design level (e.g. async/await is quickly being adopted by many languages as either a core feature or through a library that's popular). That just doesn't seem to have happened yet with the architecture around the languages yet.
      - reificator 9y ago
        > If there's one thing software engineers love, it's talking about crazy situations where nobody considered this weird edge case and how they had to scramble to fix it (I know I do). Stay awhile and listen while I discuss IE8 in quirks mode with a domain specific, terrible WYSIWYG editor from over a decade ago... > It would be really nice if many newer languages didn't act like they existed in a vacuum and no prior art existed. I don't limit that to newer languages only, and balancing the outside world with your users' needs is an invaluable skill. NPM should have known better, and it bit them hard for not doing so. But they learned very, very quickly, because if they didn't Node would have fallen overnight. I do like to make a point to not crucify people and organizations for things that have since been fixed. Yeah they were forced to, yeah it caused a lot of problems, but at the end of the day no one's using Node for pacemaker firmware or missile guidance systems. (And if you have counter examples, please don't post them for the sake of my sanity. Petition the people responsible instead.)

by inglor 9y ago

deleted 9y ago

[deleted]

reificator 9y ago

The left pad thing could have happened somewhere else, true enough. But it was far more likely to happen in Node than anywhere else, for the following two reasons: 1.) Javascript has a tiny stdlib relative to other languages that are also used for "real work". I make that distinction just to rule out LOLCode/etc.... 2.) NPM makes it so damn easy to add dependencies, both for finished products as well as component packages themselves. #2 came about because of #1, and is honestly the only way that Node could have gained traction. So while it's NPM's fault you can't really blame them for making that choice. A month or two ago I wanted to add a single NPM dependency to a project at work. I knew it built on top of other packages, but when I installed it I ended up somewhere between 690 and 700 dependencies. From typing `npm install {one-specific-package}`.

thehardsphere 9y ago
More crucially to your point 2, NPM allowed people to remove packages once they've been released, and for others to release packages with the identical name as a previously-existing package. I'm not aware of any other package managers that exhibit this rather dangerous behavior.
- deleted 9y ago
  [deleted]
- reificator 9y ago
  Yeah, I did leave that bit out, because that's an implementation detail that I believe they have since resolved. It was a massive mistake, but one that could have been avoided and has since been patched. #1 and #2 are foundational to providing Javascript on the server. You could do without #2, but because of #1 it means you'll have a harder time attracting and maintaining a userbase if you don't do it that way. This leaves you vulnerable in the long run IMO.
  - kbenson 9y ago
    > but one that could have been avoided and has since been patched. It would be really nice if many newer languages didn't act like they existed in a vacuum and no prior art existed. Package management was by no means new at the point NPM was being developed, and if they didn't have enough people with experience with the nasty edge cases package managers in other languages had discovered, it would have been trivial to solicit advice from the architects of the package systems for other languages. If there's one thing software engineers love, it's talking about crazy situations where nobody considered this weird edge case and how they had to scramble to fix it (I know I do). I think we've thankfully gotten to a spot where there's enough users and developers of modern programming languages with experience in other languages that we're seeing good cross-pollination at the language design level (e.g. async/await is quickly being adopted by many languages as either a core feature or through a library that's popular). That just doesn't seem to have happened yet with the architecture around the languages yet.
    - reificator 9y ago
      > If there's one thing software engineers love, it's talking about crazy situations where nobody considered this weird edge case and how they had to scramble to fix it (I know I do). Stay awhile and listen while I discuss IE8 in quirks mode with a domain specific, terrible WYSIWYG editor from over a decade ago... > It would be really nice if many newer languages didn't act like they existed in a vacuum and no prior art existed. I don't limit that to newer languages only, and balancing the outside world with your users' needs is an invaluable skill. NPM should have known better, and it bit them hard for not doing so. But they learned very, very quickly, because if they didn't Node would have fallen overnight. I do like to make a point to not crucify people and organizations for things that have since been fixed. Yeah they were forced to, yeah it caused a lot of problems, but at the end of the day no one's using Node for pacemaker firmware or missile guidance systems. (And if you have counter examples, please don't post them for the sake of my sanity. Petition the people responsible instead.)