3 ms·

Five hundred thousand packages, am I reading it right? I dont believe top ten OS package managers combined would reach that number. Either this is a typo or it

by gkya 9y ago

Five hundred thousand packages, am I reading it right? I dont believe top ten OS package managers combined would reach that number. Either this is a typo or it's crazy.

mbrock 9y ago
JS is the most popular language on GitHub by far, and npm is a public site where anyone can instantly upload as many new packages as they want...
raesene6 9y ago
Not a typo, http://www.modulecounts.com/ http://www.modulecounts.com/ has the details. npm is adding 497/day at the moment.
- gkya 9y ago
  This [1] is npm growth compared to anything else. God this can't be safe nor sane... [1] https://imgur.com/a/enjvR https://imgur.com/a/enjvR
  - eeZah7Ux 9y ago
    The left-pad disaster has been predicted well in advance...
    - concede_pluto 9y ago
      There's nothing especially awful about left-pad being its own package, the disaster was because a huge number of developers were betting on npm to somehow be highly available (despite being donated by its admins at no cost and with no committed SLA) rather than vendoring their deps.
      - eeZah7Ux 9y ago
        Vendoring thousands of tiny libs is even worse. Trusting many lesser known, tiny libs is more risky than few, big well known ones. Also, they are not vetted and there are much more opportunities for an attacker to sneak in a backdoored lib on the edge of the dependency graph. Finally, due to vendoring there's no way to receive timely drop-in security fixes for all dependencies from a trusted source.
        gkya 9y ago
        One can both vendor and use the package manager to fetch updates. Just add the node-modules directory to your VCS. The thing with node is that AFAIK it requires you to have libraries for what in most languages would be in the standard library. Maybe someone should start a "stdnode" project where the most popular / successful libraries for generic tasks are integrated into a dependable, maintained de-facto standard library, with an eye on quality and sanity, and community / Joyent funding.
pjmlp 9y ago
JS devs usually make packages that have single functions....

by gkya 9y ago

Five hundred thousand packages, am I reading it right? I dont believe top ten OS package managers combined would reach that number. Either this is a typo or it's crazy.

mbrock 9y ago

JS is the most popular language on GitHub by far, and npm is a public site where anyone can instantly upload as many new packages as they want...

raesene6 9y ago

Not a typo, http://www.modulecounts.com/ http://www.modulecounts.com/ has the details. npm is adding 497/day at the moment.

gkya 9y ago
This [1] is npm growth compared to anything else. God this can't be safe nor sane... [1] https://imgur.com/a/enjvR https://imgur.com/a/enjvR
- eeZah7Ux 9y ago
  The left-pad disaster has been predicted well in advance...
  - concede_pluto 9y ago
    There's nothing especially awful about left-pad being its own package, the disaster was because a huge number of developers were betting on npm to somehow be highly available (despite being donated by its admins at no cost and with no committed SLA) rather than vendoring their deps.
    - eeZah7Ux 9y ago
      Vendoring thousands of tiny libs is even worse. Trusting many lesser known, tiny libs is more risky than few, big well known ones. Also, they are not vetted and there are much more opportunities for an attacker to sneak in a backdoored lib on the edge of the dependency graph. Finally, due to vendoring there's no way to receive timely drop-in security fixes for all dependencies from a trusted source.
      - gkya 9y ago
        One can both vendor and use the package manager to fetch updates. Just add the node-modules directory to your VCS. The thing with node is that AFAIK it requires you to have libraries for what in most languages would be in the standard library. Maybe someone should start a "stdnode" project where the most popular / successful libraries for generic tasks are integrated into a dependable, maintained de-facto standard library, with an eye on quality and sanity, and community / Joyent funding.

pjmlp 9y ago

JS devs usually make packages that have single functions....