18 ms·

With transitive dependencies, the total install footprint for this is 689 packages weighing in at 77MB. This isn't reducing complexity, it's just taking all th

With transitive dependencies, the total install footprint for this is 689 packages weighing in at 77MB. This isn't reducing complexity, it's just taking all the junk you'd normally have in your bloated boilerplate and putting it directly into the build tool. I'm not convinced that's a good idea.

lojack 9y ago
Sure, its shifting complexity around, but its hard to argue that the API for this is more complex than the bloated boilerplate you're talking about. For some people the simplified API is worth the 77 extra MB.
- deleted 9y ago
  [deleted]
Semiapies 9y ago
I don't know about you, but that's where and what by i want tedious, error-prone work handled - out of my way and by the computer. If you have some simpler, better alternative to html, css, and JavaScript for websites, more power to you. Over here in the real world, though, we've got stuff to do.
krzkaczor 9y ago
What kind of argument is this? This won't be part of your bundle — it won't increase the size of your prod build but can save your precious time.
hinkley 9y ago
One of the things I like about OSS and things like Stack Overflow is that in the old days, if I solved a hard problem, I solved it for a couple dozen people I worked with and maybe some folks at my next job. In some cases it made it hard to justify the work because I saved everybody 10 minutes a month and spent a week working on it. Which may be bad math for another reason: if I saved you the most aggravating ten minutes of your month, it may be worth many multiples of that ten minutes to you. If I put the answer on the internet, then thousands of people benefit. If my work only save you five minutes one time, it still may be worth the bother in the grand scheme of things. Which is a long way around to my point: this group is curating a bunch of build related modules which means I don't have to pay as much attention. That's not automatically a win (especially if they do a poor job of keeping up, which happens a lot in this space), but it has potential at least to be pretty useful.
nine_k 9y ago
See it as a silly but efficient cache. Well, npm may implement some kind of content-addressable storage to transparently deduplicate the dependencies tree on disk. It's not quite easy to do well. As long as your bundle size is small, and the build times are fast, it's a clear improvement, at the expense of spending like 0.15% of even the cheapest 60GB SSD.
Klonoar 9y ago
Mmmm, so... sub 100MB for a bundler + compiler + etc? - Xcode, for iOS/Mac Development, is usually around 5GB (and no, even if you remove every single simulator, it's still over 100-200MB). - Android Studio is roughly the same deal as Xcode. - I've not used Windows so I can't say for sure, but I'd be surprised if the various tech there doesn't follow this pattern. 77MB is nothing, and if you care about this, you're caring about the wrong things.
- cnp 9y ago
  Exactly
- segphault 9y ago
  689 packages is enormous surface area for a leftpad-like (or worse) failure. Given that nobody is auditing those packages and many of the people who maintain them aren't adhering to best security practices[1], I don't think taking nearly 700 dependencies that you are going to treat like a black box is a safe or responsible choice. Xcode and the Android SDK each come from a single vendor who provides an integrated development stack and presumably vets the contents. Does anybody do that with these npm packages? It seems like every time I run the du command in my node_modules folder, I find some crap that shouldn't be there. Earlier this year, I submitted a PR that reduced the size of the babel react preset install footprint by about a third, just by removing a totally unused dependency that nobody noticed. I don't think the contents of npm packages get nearly enough scrutiny and it scares the hell out of me. [1] https://www.bleepingcomputer.com/news/security/52-percent-of-all-javascript-npm-packages-could-have-been-hacked-via-weak-credentials/ https://www.bleepingcomputer.com/news/security/52-percent-of...
  - liamfd 9y ago
    Would you mind linking to your PR? Would love to take a look.
    - segphault 9y ago
      It literally just removes a line from the package.json file of one of the sub-dependencies: https://github.com/babel/babel/pull/5484 https://github.com/babel/babel/pull/5484 It's crazy to me that a package that is downloaded from npm over 4 million times a month gets so little scrutiny that nobody but me noticed a 5MB dependency on all of lodash that wasn't even being used.

lojack 9y ago

Sure, its shifting complexity around, but its hard to argue that the API for this is more complex than the bloated boilerplate you're talking about. For some people the simplified API is worth the 77 extra MB.

deleted 9y ago
[deleted]

Semiapies 9y ago

I don't know about you, but that's where and what by i want tedious, error-prone work handled - out of my way and by the computer. If you have some simpler, better alternative to html, css, and JavaScript for websites, more power to you. Over here in the real world, though, we've got stuff to do.

krzkaczor 9y ago

What kind of argument is this? This won't be part of your bundle — it won't increase the size of your prod build but can save your precious time.

hinkley 9y ago

One of the things I like about OSS and things like Stack Overflow is that in the old days, if I solved a hard problem, I solved it for a couple dozen people I worked with and maybe some folks at my next job. In some cases it made it hard to justify the work because I saved everybody 10 minutes a month and spent a week working on it. Which may be bad math for another reason: if I saved you the most aggravating ten minutes of your month, it may be worth many multiples of that ten minutes to you. If I put the answer on the internet, then thousands of people benefit. If my work only save you five minutes one time, it still may be worth the bother in the grand scheme of things. Which is a long way around to my point: this group is curating a bunch of build related modules which means I don't have to pay as much attention. That's not automatically a win (especially if they do a poor job of keeping up, which happens a lot in this space), but it has potential at least to be pretty useful.

nine_k 9y ago

See it as a silly but efficient cache. Well, npm may implement some kind of content-addressable storage to transparently deduplicate the dependencies tree on disk. It's not quite easy to do well. As long as your bundle size is small, and the build times are fast, it's a clear improvement, at the expense of spending like 0.15% of even the cheapest 60GB SSD.

Klonoar 9y ago

Mmmm, so... sub 100MB for a bundler + compiler + etc? - Xcode, for iOS/Mac Development, is usually around 5GB (and no, even if you remove every single simulator, it's still over 100-200MB). - Android Studio is roughly the same deal as Xcode. - I've not used Windows so I can't say for sure, but I'd be surprised if the various tech there doesn't follow this pattern. 77MB is nothing, and if you care about this, you're caring about the wrong things.

cnp 9y ago
Exactly
segphault 9y ago
689 packages is enormous surface area for a leftpad-like (or worse) failure. Given that nobody is auditing those packages and many of the people who maintain them aren't adhering to best security practices[1], I don't think taking nearly 700 dependencies that you are going to treat like a black box is a safe or responsible choice. Xcode and the Android SDK each come from a single vendor who provides an integrated development stack and presumably vets the contents. Does anybody do that with these npm packages? It seems like every time I run the du command in my node_modules folder, I find some crap that shouldn't be there. Earlier this year, I submitted a PR that reduced the size of the babel react preset install footprint by about a third, just by removing a totally unused dependency that nobody noticed. I don't think the contents of npm packages get nearly enough scrutiny and it scares the hell out of me. [1] https://www.bleepingcomputer.com/news/security/52-percent-of-all-javascript-npm-packages-could-have-been-hacked-via-weak-credentials/ https://www.bleepingcomputer.com/news/security/52-percent-of...
- liamfd 9y ago
  Would you mind linking to your PR? Would love to take a look.
  - segphault 9y ago
    It literally just removes a line from the package.json file of one of the sub-dependencies: https://github.com/babel/babel/pull/5484 https://github.com/babel/babel/pull/5484 It's crazy to me that a package that is downloaded from npm over 4 million times a month gets so little scrutiny that nobody but me noticed a 5MB dependency on all of lodash that wasn't even being used.