4 ms·

I will take a stap at comparing npm vs pypi. While this will be anecdotal I found my `pip freeze` packages a lot more manageable compared to `npm ls --parseabl

I will take a stap at comparing npm vs pypi. While this will be anecdotal I found my `pip freeze` packages a lot more manageable compared to `npm ls --parseable`. My Full Stack Flask application sits at about 64 requirements. Where last time I used expressjs my dependancies inside of node_modules inside of node_modules border-lined to insanity. I can see myself hand picking and reviewing my requirements.txt, which I did to some extent. But I just gave up with npm. Which is a bit of a personal dilemma for me, because some of my tooling needs npm.

ehnto 8y ago
So many packages and authors creates an impossibly large surface area to review and secure. It is my impression that most people don't even try so the issue falls on deaf ears. But for a PCI compliant piece of software for example, you would have to had reviewed every module in node_modules. As a stack it makes it a non-starter.
cup-of-tea 8y ago
I've been doing Python for over five years now. I recently installed a small command line tool using npm. I was completely stunned by the number of dependencies. At first I thought it must be something else, like maybe it's running tests? But no, hundreds of dependencies. If it were written in python it probably wouldn't even have one.
eeZah7Ux 8y ago
In Python, 64 dependencies is quite a lot. Most services can be build with less that 5 or 10 well-known, trusted libraries. The numbers and ecosystem maturity make a huge difference in being able to vet dependencies.
inapis 8y ago
You’re not OP but you’ve move the goal posts from security to number of dependencies. I think GP was focusing on how are other package managers different from npm when it comes to security except maybe apt and pacman? And node_modules is now a flat tree for the most part. The number of dependencies a basic JavaScript project pulls is definitely something to be concerned about though.

ehnto 8y ago

So many packages and authors creates an impossibly large surface area to review and secure. It is my impression that most people don't even try so the issue falls on deaf ears. But for a PCI compliant piece of software for example, you would have to had reviewed every module in node_modules. As a stack it makes it a non-starter.

cup-of-tea 8y ago

I've been doing Python for over five years now. I recently installed a small command line tool using npm. I was completely stunned by the number of dependencies. At first I thought it must be something else, like maybe it's running tests? But no, hundreds of dependencies. If it were written in python it probably wouldn't even have one.

eeZah7Ux 8y ago

In Python, 64 dependencies is quite a lot. Most services can be build with less that 5 or 10 well-known, trusted libraries. The numbers and ecosystem maturity make a huge difference in being able to vet dependencies.

inapis 8y ago

You’re not OP but you’ve move the goal posts from security to number of dependencies. I think GP was focusing on how are other package managers different from npm when it comes to security except maybe apt and pacman? And node_modules is now a flat tree for the most part. The number of dependencies a basic JavaScript project pulls is definitely something to be concerned about though.