5 ms·
This is the modern Javascript coding style - you install small packages that implement your required functionality. The idea is to not solve problems that were
by nukeop 9y ago
This is the modern Javascript coding style - you install small packages that implement your required functionality. The idea is to not solve problems that were solved before by somebody else. After all, if you're going to include somebody else's code that you didn't write anyway, what's the better way to do it - copy & paste, or use a package manager with versioning and high degree of control over downloaded packages that lets you abstract the required functionality away into a single line?
What is to be avoided is inclusion of packages that implement a ton of functionalities, and then only using a very small subset of those. In these cases it's better to create your own solution.
- westoque 9y agoThis is what separates experienced coders from amateurs imo. I’ve seen newer programmers tend to always “find” a library that would implement their required solution even what they needed is a super small subset of that library which could have been better off by just writing their own function.
- get 9y agowhat's the better way to do it copy & paste, or use a package manager When you add a dependency, how do you prevent the maintainer of the dependency or any sub- or sub-sub-...dependency to break your system in the future?
- nukeop 9y agoYou do the same thing you'd do if anything else in your toolchain or runtime environment changes - change relevant code so it works again. Browsers change all sorts of stuff all the time and break millions of websites in the process. Easier to use a package manager to propagate the required changes to all dependent projects than copying and pasting bits of code between many different files.
- get 9y agoThat sounds scary. That means the security of your system and data is at the mercy of all those maintainers? I can't imagine any big companies work like that. Execute code on their servers which is under the control of 'somebody from the internet'.
- nukeop 9y agoI can't imagine the opposite could ever happen, be it small companies or big ones - there is not a single company on Earth that has the time to audit every line of every piece of software they run. Especially if that software is proprietary and source isn't even available.
- get 9y agoIt's not about auditing every line of code. It's about a chain of trust. I can not imagine that the security of Facebooks servers is at the mercy of a chain of anonymous coders.
- tpxl 9y agoYou do what any sane package manager does and pin the version. Having the option to declare a dependency version as >= 4.0.3 is a bug, not a feature.
- get 9y agoSo you first recursively read the code and the code of all the dependencies? And then pin it? That sounds like a lot of work. Compared to copying/writing 30 lines. How do you know the pinned version and it's dependencies do not get changed by the maintainers?
- tpxl 9y agoI meant as a solution to not breaking in the future. If you have a system with pinned versions that work, it will always work, regardless of the changes in new versions.