3 ms·

More crucially to your point 2, NPM allowed people to remove packages once they've been released, and for others to release packages with the identical name as

More crucially to your point 2, NPM allowed people to remove packages once they've been released, and for others to release packages with the identical name as a previously-existing package. I'm not aware of any other package managers that exhibit this rather dangerous behavior.

deleted 9y ago
[deleted]
reificator 9y ago
Yeah, I did leave that bit out, because that's an implementation detail that I believe they have since resolved. It was a massive mistake, but one that could have been avoided and has since been patched. #1 and #2 are foundational to providing Javascript on the server. You could do without #2, but because of #1 it means you'll have a harder time attracting and maintaining a userbase if you don't do it that way. This leaves you vulnerable in the long run IMO.
- kbenson 9y ago
  > but one that could have been avoided and has since been patched. It would be really nice if many newer languages didn't act like they existed in a vacuum and no prior art existed. Package management was by no means new at the point NPM was being developed, and if they didn't have enough people with experience with the nasty edge cases package managers in other languages had discovered, it would have been trivial to solicit advice from the architects of the package systems for other languages. If there's one thing software engineers love, it's talking about crazy situations where nobody considered this weird edge case and how they had to scramble to fix it (I know I do). I think we've thankfully gotten to a spot where there's enough users and developers of modern programming languages with experience in other languages that we're seeing good cross-pollination at the language design level (e.g. async/await is quickly being adopted by many languages as either a core feature or through a library that's popular). That just doesn't seem to have happened yet with the architecture around the languages yet.
  - reificator 9y ago
    > If there's one thing software engineers love, it's talking about crazy situations where nobody considered this weird edge case and how they had to scramble to fix it (I know I do). Stay awhile and listen while I discuss IE8 in quirks mode with a domain specific, terrible WYSIWYG editor from over a decade ago... > It would be really nice if many newer languages didn't act like they existed in a vacuum and no prior art existed. I don't limit that to newer languages only, and balancing the outside world with your users' needs is an invaluable skill. NPM should have known better, and it bit them hard for not doing so. But they learned very, very quickly, because if they didn't Node would have fallen overnight. I do like to make a point to not crucify people and organizations for things that have since been fixed. Yeah they were forced to, yeah it caused a lot of problems, but at the end of the day no one's using Node for pacemaker firmware or missile guidance systems. (And if you have counter examples, please don't post them for the sake of my sanity. Petition the people responsible instead.)

deleted 9y ago

[deleted]

reificator 9y ago

Yeah, I did leave that bit out, because that's an implementation detail that I believe they have since resolved. It was a massive mistake, but one that could have been avoided and has since been patched. #1 and #2 are foundational to providing Javascript on the server. You could do without #2, but because of #1 it means you'll have a harder time attracting and maintaining a userbase if you don't do it that way. This leaves you vulnerable in the long run IMO.

kbenson 9y ago
> but one that could have been avoided and has since been patched. It would be really nice if many newer languages didn't act like they existed in a vacuum and no prior art existed. Package management was by no means new at the point NPM was being developed, and if they didn't have enough people with experience with the nasty edge cases package managers in other languages had discovered, it would have been trivial to solicit advice from the architects of the package systems for other languages. If there's one thing software engineers love, it's talking about crazy situations where nobody considered this weird edge case and how they had to scramble to fix it (I know I do). I think we've thankfully gotten to a spot where there's enough users and developers of modern programming languages with experience in other languages that we're seeing good cross-pollination at the language design level (e.g. async/await is quickly being adopted by many languages as either a core feature or through a library that's popular). That just doesn't seem to have happened yet with the architecture around the languages yet.
- reificator 9y ago
  > If there's one thing software engineers love, it's talking about crazy situations where nobody considered this weird edge case and how they had to scramble to fix it (I know I do). Stay awhile and listen while I discuss IE8 in quirks mode with a domain specific, terrible WYSIWYG editor from over a decade ago... > It would be really nice if many newer languages didn't act like they existed in a vacuum and no prior art existed. I don't limit that to newer languages only, and balancing the outside world with your users' needs is an invaluable skill. NPM should have known better, and it bit them hard for not doing so. But they learned very, very quickly, because if they didn't Node would have fallen overnight. I do like to make a point to not crucify people and organizations for things that have since been fixed. Yeah they were forced to, yeah it caused a lot of problems, but at the end of the day no one's using Node for pacemaker firmware or missile guidance systems. (And if you have counter examples, please don't post them for the sake of my sanity. Petition the people responsible instead.)