4 ms·

Reason 2 is getting out of hand for Python, Ruby, JavaScript, Haskell and OCaml. These so called package manager can't manage packages at all. I'd like to cal

• bdcravens 8y ago
  > They just download everything from language interpreter to library to a single directory and call it job done. This is scoped to the project in npm. In Ruby, you can specify the path (common to "vendor" your gems). You can use version managers (like rvm or nvm) to scope your libs to versions or even named projects (thinking of rvm's "gemsets") > The interpreter and library's version is forever fixed. Theoretically, it can upgrade the version but the user mostly don't. I can't speak for all ecosystems, but on Ruby projects I've been a part of, keeping gems updated is pretty common. Github even includes monitoring for vulnerabilities to encourage this. Having been part of ecosystems that don't have package management (for example, ColdFusion) even the worst package managers are a major improvement. (Though I do think the isolation of python's virtualenvs is a better approach than most systems)
• ubernostrum 8y ago
  No easy way to remove the package. "pip uninstall" has been around as long as pip has. Theoretically, it can upgrade the version but the user mostly don't. In practice, people deploy to a virtualenv that gets recreated on each deployment, and tend to treat a virtualenv as an ephemeral thing.