3 ms·

npm is the worst software I use daily. * The maintainers have pushed several breaking updates by mistake (I'm a teapot recently). * There have been a few casc

npm is the worst software I use daily. * The maintainers have pushed several breaking updates by mistake (I'm a teapot recently). * There have been a few cascading failures due to the ecosystem (leftpad). * node-gyp (alluded to in the talk) break cryptically on install in different operating system/package combinations. It also obscures the actual package contents. * The lack of package signatures and things like namespace squatting significantly hurt the overall security of npm. And let's not forget how terrible things were pre-yarn with the nested folder structure of node_modules and no lock file. Compare that to NuGet where I've literally never had any of these problems.

xab9 8y ago
I can't argue with you, but "most of the time" it works. Not that I have a choice (unless I stop being a frontend developer), but the time we spend with node/npm debugging is not critical in the timesheet/log.
- pjmlp 8y ago
  There is a choice, I do native frontend.
  - xab9 8y ago
    What tech are you using? Guess not react native then :)
    - pjmlp 8y ago
      Windows Forms, WPF, UWP, Android, Qt, depending on the project.
darzu 8y ago
Here's one thing Node and npm are great at and NuGet fails at completely: local development of two packages. With npm, I can use "npm link" to redirect a package reference to a local folder. With NuGet, the best you an do is edit the .csproj and change the nuget reference to a project reference (if you can find the original source code). This makes simple step-through debugging across package boundaries a chore every time, whereas a source-based package system doesn't have this issue.
- n0us 8y ago
  "npm link" only establishes a symlink between the two directories and doesn't respect .npmignore or behave in any comparable way to publishing a package and installing it. Sometimes the only way to debug is to repeatedly publish and re-install the package you are developing.

xab9 8y ago

I can't argue with you, but "most of the time" it works. Not that I have a choice (unless I stop being a frontend developer), but the time we spend with node/npm debugging is not critical in the timesheet/log.

pjmlp 8y ago
There is a choice, I do native frontend.
- xab9 8y ago
  What tech are you using? Guess not react native then :)
  - pjmlp 8y ago
    Windows Forms, WPF, UWP, Android, Qt, depending on the project.

darzu 8y ago

Here's one thing Node and npm are great at and NuGet fails at completely: local development of two packages. With npm, I can use "npm link" to redirect a package reference to a local folder. With NuGet, the best you an do is edit the .csproj and change the nuget reference to a project reference (if you can find the original source code). This makes simple step-through debugging across package boundaries a chore every time, whereas a source-based package system doesn't have this issue.

n0us 8y ago
"npm link" only establishes a symlink between the two directories and doesn't respect .npmignore or behave in any comparable way to publishing a package and installing it. Sometimes the only way to debug is to repeatedly publish and re-install the package you are developing.