4 ms·

I'd love to do this, but how can you review thousands of lines of code that changed?

by ttty 8y ago

albertgoeswoof 8y ago
Ideally you don’t pull in thousands of lines of code in unknown dependencies as a starting point
twodave 8y ago
You can't, you're forced to trust to some degree depending on factors specific to your project. If you're writing missile navigation code then you better check every last diff, but if you're writing a recipe sharing site then you don't have the same burden really.
kd5bjo 8y ago
You can use smaller, more targeted libraries so that the changes you need to review are actually relevant to your project.
- sulam 8y ago
  In the Node/NPM world, this is pretty difficult. There are many (many) small libraries and everything you depend on brings in many more.
  - gkya 8y ago
    That's a big and totally objective reason to abandom the Node.js/NPM ecosystem, like its original author did. A language that doesn't have a decent standard library means that you'll have to use huge amounts of code that random strangers used, and the chain of dependencies will grow larger and larger. In languages like Ruby and Python, you have a decent standard library, and then big libraries and frameworks that are maintained by the community, like Rails, Django, SqlAlchemy, Numpy, etc. That's healthy because it minimises or zeros the amount of small libraries maintained by a single guy, thus maximising the amount of code that you can trust (because you can trust the devs and development process of a popular library backed by a foundation or with many contributors). With Node, almost every function comes from a different package. And there's no bar to entry, and no checks. If Node.js is going to stay, someone needs to take on the responsability of forming a project, that belongs to an NGO or something, where the more popular libraries are merged and fused into a standard library, like that of Python's. Personally, I'm not touching it until then.

I'd love to do this, but how can you review thousands of lines of code that changed?

by ttty 8y ago

I'd love to do this, but how can you review thousands of lines of code that changed?

albertgoeswoof 8y ago

Ideally you don’t pull in thousands of lines of code in unknown dependencies as a starting point

twodave 8y ago

You can't, you're forced to trust to some degree depending on factors specific to your project. If you're writing missile navigation code then you better check every last diff, but if you're writing a recipe sharing site then you don't have the same burden really.

kd5bjo 8y ago

You can use smaller, more targeted libraries so that the changes you need to review are actually relevant to your project.

sulam 8y ago
In the Node/NPM world, this is pretty difficult. There are many (many) small libraries and everything you depend on brings in many more.
- gkya 8y ago
  That's a big and totally objective reason to abandom the Node.js/NPM ecosystem, like its original author did. A language that doesn't have a decent standard library means that you'll have to use huge amounts of code that random strangers used, and the chain of dependencies will grow larger and larger. In languages like Ruby and Python, you have a decent standard library, and then big libraries and frameworks that are maintained by the community, like Rails, Django, SqlAlchemy, Numpy, etc. That's healthy because it minimises or zeros the amount of small libraries maintained by a single guy, thus maximising the amount of code that you can trust (because you can trust the devs and development process of a popular library backed by a foundation or with many contributors). With Node, almost every function comes from a different package. And there's no bar to entry, and no checks. If Node.js is going to stay, someone needs to take on the responsability of forming a project, that belongs to an NGO or something, where the more popular libraries are merged and fused into a standard library, like that of Python's. Personally, I'm not touching it until then.