4 ms·
What makes npm particularly bad, is that JS has such a teribad stdlib. When you need to write your own lpad() at some point its easier to include a stupid littl
by milesvp 9y ago
What makes npm particularly bad, is that JS has such a teribad stdlib. When you need to write your own lpad() at some point its easier to include a stupid little package that has dealt with all the edge cases you don't want to care about. So you end up with way more third party deps than a kitchen sink type language.
Otherwise, yes this is a fundamental dependency issue.
- chmln 9y agoYou can actually pad your strings now https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/padStart https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- swyx 9y agocould we actually take a snapshot of npm’s top used but relatively inert libraries every 6 months or so and freeze them? (call it UserlandJS 2018a, 2018b, etc) and then have a separate dependency manager that only downloads those frozen libraries we include. Userland Package Manager or something. this would approach a stdlib without much effort and we would have more of a chance to catch up on malicious security stuff since there are commonly agreed upon frozen versions that everyone can pore over. im a total noob at security, please attack/modify this idea if it has any value?
- swyx 9y agodiscussing on twitter here https://twitter.com/swyx/status/949946224043610112 https://twitter.com/swyx/status/949946224043610112
- jmadsen 9y agobut that has nothing to do with npm. that's the same for any javascript package manager - yarn or bower would be the same.