3 ms·

There is no "perhaps" about npm, it is absolutely a shit show. It's like the creators went out of their way to build an ecosystem of security nightmares.

outside1234 8y ago
ok, hang on, how is npm different from maven, pypi, etc. ?
- oneweekwonder 8y ago
  I will take a stap at comparing npm vs pypi. While this will be anecdotal I found my `pip freeze` packages a lot more manageable compared to `npm ls --parseable`. My Full Stack Flask application sits at about 64 requirements. Where last time I used expressjs my dependancies inside of node_modules inside of node_modules border-lined to insanity. I can see myself hand picking and reviewing my requirements.txt, which I did to some extent. But I just gave up with npm. Which is a bit of a personal dilemma for me, because some of my tooling needs npm.
  - ehnto 8y ago
    So many packages and authors creates an impossibly large surface area to review and secure. It is my impression that most people don't even try so the issue falls on deaf ears. But for a PCI compliant piece of software for example, you would have to had reviewed every module in node_modules. As a stack it makes it a non-starter.
  - cup-of-tea 8y ago
    I've been doing Python for over five years now. I recently installed a small command line tool using npm. I was completely stunned by the number of dependencies. At first I thought it must be something else, like maybe it's running tests? But no, hundreds of dependencies. If it were written in python it probably wouldn't even have one.
  - eeZah7Ux 8y ago
    In Python, 64 dependencies is quite a lot. Most services can be build with less that 5 or 10 well-known, trusted libraries. The numbers and ecosystem maturity make a huge difference in being able to vet dependencies.
  - inapis 8y ago
    You’re not OP but you’ve move the goal posts from security to number of dependencies. I think GP was focusing on how are other package managers different from npm when it comes to security except maybe apt and pacman? And node_modules is now a flat tree for the most part. The number of dependencies a basic JavaScript project pulls is definitely something to be concerned about though.
- earenndil 8y ago
  It's not a technical issue, it's a cultural one.
  - paulie_a 8y ago
    It is both
- paulie_a 8y ago
  Because I need 90,000 stupid packages on npm which can be disabled and removed at any moment. Vs python which mostly requires 20-100 if you are really making a complex system. Also the versioning on npm is incredibly pathetic vs pypi. I would never trust npm for anything serious or waste my time debugging that crap.
  - overkalix 8y ago
    Not a webdev, but from what I've seen webdevs are forced to compete, not in what they can do, but in terms of how they can do it (frameworks, packages). So, an aspect of your work process becomes a proxy for the quality of your work. In a context of permanent competition, this forces an acritical and rapid adoption of frameworks that perhaps only marginally improve some aspects of some other frameworks. Then compound this with the inflow of bootcamp-trained webdevs with poor practices whose employability relies on having being recently trained on the latest hyped framework.
    - heavenlyblue 8y ago
      No, JavaScript just doesn't have a standard library. And even if you think it does - then look at what Py std has to offer.
jchw 8y ago
I'm not making claims either way. I don't like NPM either, it just wasn't relevant to what I was saying.

outside1234 8y ago

ok, hang on, how is npm different from maven, pypi, etc. ?

oneweekwonder 8y ago
I will take a stap at comparing npm vs pypi. While this will be anecdotal I found my `pip freeze` packages a lot more manageable compared to `npm ls --parseable`. My Full Stack Flask application sits at about 64 requirements. Where last time I used expressjs my dependancies inside of node_modules inside of node_modules border-lined to insanity. I can see myself hand picking and reviewing my requirements.txt, which I did to some extent. But I just gave up with npm. Which is a bit of a personal dilemma for me, because some of my tooling needs npm.
- ehnto 8y ago
  So many packages and authors creates an impossibly large surface area to review and secure. It is my impression that most people don't even try so the issue falls on deaf ears. But for a PCI compliant piece of software for example, you would have to had reviewed every module in node_modules. As a stack it makes it a non-starter.
- cup-of-tea 8y ago
  I've been doing Python for over five years now. I recently installed a small command line tool using npm. I was completely stunned by the number of dependencies. At first I thought it must be something else, like maybe it's running tests? But no, hundreds of dependencies. If it were written in python it probably wouldn't even have one.
- eeZah7Ux 8y ago
  In Python, 64 dependencies is quite a lot. Most services can be build with less that 5 or 10 well-known, trusted libraries. The numbers and ecosystem maturity make a huge difference in being able to vet dependencies.
- inapis 8y ago
  You’re not OP but you’ve move the goal posts from security to number of dependencies. I think GP was focusing on how are other package managers different from npm when it comes to security except maybe apt and pacman? And node_modules is now a flat tree for the most part. The number of dependencies a basic JavaScript project pulls is definitely something to be concerned about though.
earenndil 8y ago
It's not a technical issue, it's a cultural one.
- paulie_a 8y ago
  It is both
paulie_a 8y ago
Because I need 90,000 stupid packages on npm which can be disabled and removed at any moment. Vs python which mostly requires 20-100 if you are really making a complex system. Also the versioning on npm is incredibly pathetic vs pypi. I would never trust npm for anything serious or waste my time debugging that crap.
- overkalix 8y ago
  Not a webdev, but from what I've seen webdevs are forced to compete, not in what they can do, but in terms of how they can do it (frameworks, packages). So, an aspect of your work process becomes a proxy for the quality of your work. In a context of permanent competition, this forces an acritical and rapid adoption of frameworks that perhaps only marginally improve some aspects of some other frameworks. Then compound this with the inflow of bootcamp-trained webdevs with poor practices whose employability relies on having being recently trained on the latest hyped framework.
  - heavenlyblue 8y ago
    No, JavaScript just doesn't have a standard library. And even if you think it does - then look at what Py std has to offer.

jchw 8y ago

I'm not making claims either way. I don't like NPM either, it just wasn't relevant to what I was saying.