4 ms·

Hi, appreciate the followup, apologies for the previous short comment. I feel like it's clickbait, not worth reading, for these points: 1. Even if the argumen

by sbr464 9y ago

Hi, appreciate the followup, apologies for the previous short comment. I feel like it's clickbait, not worth reading, for these points: 1. Even if the argument is valid, the points made in this article have been expressed, shared, (whined about?) probably 9+ times in my own reading. It's really time to move on. 2. There is nothing inherently wrong with using small/simple modules. Once you start to reuse code in many projects, the value becomes clear. Some are juicy and complex, some are eye-bleeding simple. It's better than copying and pasting code around folders. Use org modules/private modules and the problem is solved. I absolutely believe that npm is ripe for *potential abuse, although I have yet to have any issues. No one has time for Breitbart-esque fearmongering, or the regurgitation of stale points while an ample selection of real world problems exist to be solved. Jeez that reads harsh. Apologies, it's late.

deleted 9y ago
[deleted]
zaarn 9y ago
Not worth reading is different to clickbait. Clickbait is specifically a sensationalist headline that is above content with little to no actual journalistic value. The title of the post is a quite accurate summary of the entire text in a few words, so I think it totally serves it's purpose as a title. It matters little that the arguments have been brought up before, that only makes the article stale but not clickbait in of itself. Now, if there was a lack of an actual, journalistic article below the headline I might be more inclined to agree it being clickbait.
movedx 9y ago
> apologies for the previous short comment. > Jeez that reads harsh. Apologies, it's late. All good, friend. > ... It's really time to move on. But is it? I fear that if this is a genuine issue, why would I want to move on from it? Essentially npm is enabling people to build bridges in the same way steel is helping people to build actual bridges. If there was a flaw in some steel production process, I wouldn't ignore it. People could suffer. Extreme(?) examples a side, if it's an issue, why not aim to solve it? This seems to pop up a lot, so perhaps it's time for a (long-term) solution? > Use org modules/private modules and the problem is solved. Yes! This is where I personally see the long-term solution: pick your top-level deps, (permanently) cache them locally and validate them, then implement/use them. Only update the cache when you're confident the remote, official copy has been changed in a manner that's safe for you and or your users. > I absolutely believe that npm is ripe for *potential abuse, although I have yet to have any issues. How do you know you've not had any issues? If I was attacking you via some sort of "side channel" attack, like breaching and injecting bad code into an NPM module I know you're using, how would you know it's happened? Are you using a CI/CD process? The changes are high that you are and therefore unless you've version/commit pinning, it's likely you're blind to those deps being updated during your build process, enabling me to perform said "side channel" attack. > No one has time for Breitbart-esque fearmongering, or the regurgitation of stale points while an ample selection of real world problems exist to be solved. If it's being regurgitated so much, perhaps it is a "real world" problem to be solved.
- Can_Not 9y ago
  > If it's being regurgitated so much, perhaps it is a "real world" problem to be solved. I don't think most people deny that it's a problem or that it needs to be fixed. But completely blown out of proportion with Breitbart-esque fear-mongering is something that needs to stop. People still talk about "leftpad" as if it wasn't fixed the same day, sometimes as if it were never fixed, sometimes even as if it isn't even possible to write software in NodeJS. I haven't seen a fair and factual comparison chart of npm vs pip vs crate vs composer, and I'm calling BS that the majority of this "concern" is anything more than trendy JavaScript-Hate until I see one.
pluma 9y ago
Having written my fair share of tiny trivial modules, I think tree-shaking may actually help with the "everything's a package" craze that followed the early size concerns. Lodash and date-fns for example are similarly feature complete and "big" as underscore and moment.js but their structure allows using them as "a la carte" collections of tiny helper functions without bloating the frontend bundle. The fearmongering does get on your nerves but I think it's undeniable that npm's version conflict resolution (i.e. "have your cake and eat it too") has led to more complex dependency trees than e.g. in Python where the need to avoid version conflicts creates an inherent aversion to adding too many dependencies. However I think it's also undeniable that this has in turn enabled a lot of growth and innovation.
caspervonb 9y ago
> Breitbart-esque fearmongering WTH is Breitbart? Bart Simpsons's evil twin?
- corrigible 9y ago
  Apparently it's an American alt-right news platform

by sbr464 9y ago

deleted 9y ago

[deleted]

zaarn 9y ago

Not worth reading is different to clickbait. Clickbait is specifically a sensationalist headline that is above content with little to no actual journalistic value. The title of the post is a quite accurate summary of the entire text in a few words, so I think it totally serves it's purpose as a title. It matters little that the arguments have been brought up before, that only makes the article stale but not clickbait in of itself. Now, if there was a lack of an actual, journalistic article below the headline I might be more inclined to agree it being clickbait.

movedx 9y ago

> apologies for the previous short comment. > Jeez that reads harsh. Apologies, it's late. All good, friend. > ... It's really time to move on. But is it? I fear that if this is a genuine issue, why would I want to move on from it? Essentially npm is enabling people to build bridges in the same way steel is helping people to build actual bridges. If there was a flaw in some steel production process, I wouldn't ignore it. People could suffer. Extreme(?) examples a side, if it's an issue, why not aim to solve it? This seems to pop up a lot, so perhaps it's time for a (long-term) solution? > Use org modules/private modules and the problem is solved. Yes! This is where I personally see the long-term solution: pick your top-level deps, (permanently) cache them locally and validate them, then implement/use them. Only update the cache when you're confident the remote, official copy has been changed in a manner that's safe for you and or your users. > I absolutely believe that npm is ripe for *potential abuse, although I have yet to have any issues. How do you know you've not had any issues? If I was attacking you via some sort of "side channel" attack, like breaching and injecting bad code into an NPM module I know you're using, how would you know it's happened? Are you using a CI/CD process? The changes are high that you are and therefore unless you've version/commit pinning, it's likely you're blind to those deps being updated during your build process, enabling me to perform said "side channel" attack. > No one has time for Breitbart-esque fearmongering, or the regurgitation of stale points while an ample selection of real world problems exist to be solved. If it's being regurgitated so much, perhaps it is a "real world" problem to be solved.

Can_Not 9y ago
> If it's being regurgitated so much, perhaps it is a "real world" problem to be solved. I don't think most people deny that it's a problem or that it needs to be fixed. But completely blown out of proportion with Breitbart-esque fear-mongering is something that needs to stop. People still talk about "leftpad" as if it wasn't fixed the same day, sometimes as if it were never fixed, sometimes even as if it isn't even possible to write software in NodeJS. I haven't seen a fair and factual comparison chart of npm vs pip vs crate vs composer, and I'm calling BS that the majority of this "concern" is anything more than trendy JavaScript-Hate until I see one.

pluma 9y ago

Having written my fair share of tiny trivial modules, I think tree-shaking may actually help with the "everything's a package" craze that followed the early size concerns. Lodash and date-fns for example are similarly feature complete and "big" as underscore and moment.js but their structure allows using them as "a la carte" collections of tiny helper functions without bloating the frontend bundle. The fearmongering does get on your nerves but I think it's undeniable that npm's version conflict resolution (i.e. "have your cake and eat it too") has led to more complex dependency trees than e.g. in Python where the need to avoid version conflicts creates an inherent aversion to adding too many dependencies. However I think it's also undeniable that this has in turn enabled a lot of growth and innovation.

caspervonb 9y ago

> Breitbart-esque fearmongering WTH is Breitbart? Bart Simpsons's evil twin?

corrigible 9y ago
Apparently it's an American alt-right news platform