10 ms·
Title could be improved, as I was wondering if the command line tool npm had itself been rewritten. It’s actually one of npm’s web services that was rewritten.
by javagram 8y ago
Title could be improved, as I was wondering if the command line tool npm had itself been rewritten.
It’s actually one of npm’s web services that was rewritten.
FTA: “Java was excluded from consideration because of the requirement of deploying the JVM and associated libraries along with any program to their production servers. This was an amount of operational complexity and resource overhead that was as undesirable as the unsafety of C or C++.”
I find this comparison a bit odd. Even if not using containers, the JVM isn’t hard to deploy as distro package managers include it. Unless a team is managing servers manually rather than an automated tool this doesn’t seem that complex. Am I missing something here?
- brazzledazzle 8y agoIf I have a choice between dealing with it and not I’ll choose not every time. It’s an annoying dependency that got even more annoying when Oracle decided to be a pain in the ass. Just because something is “easy” doesn’t mean it’s easier than the alternative.
- feikname 8y agoJVM tuning (especially the GC and memory allocation scaling) can be a huge PITA.
- simion314 8y agoBut having options is always good, isn't the same with compiled languages? you keep the defaults options but if you want extra performance you try different compiler flags or different compiler if the language has more then one.
- weberc2 8y agoHonestly I’d rather have good defaults than lots of options. If one tool meets requirements out of the box, then it’s preferable to a tool that requires a lot of tooling.
- simion314 8y agoBut if you do not have options then what is a "good default" , you have a default option if you have more then an option, so you prefer software with no options? Can you give examples of languages(compilers or VMs with bad defaults in your opinion?
- weberc2 8y agoYou can have options and have good default values for those options. Good default values are those that are reasonable for most people most of the time such that they don't need to be (or hire) domain experts to properly configure their tool. My opinion of a bad default would include a language toolchain which defaults to dynamic linking and requires one to opt into static linking (Java, Python, JS, etc, etc, etc). Worse than that is an anorexic toolchain that has no defaults whatsoever and requires you to pass every little detail directly to the compiler--bonus points if your language has a massive ecosystem of competing tools which are meant to manage these sorts of details for you but utterly and uniformly fail to do so (looking at you, C/C++).
- simion314 8y agoSo the JVM run-time is installed and used by average people, so the defaults should be set for this people that install Java to run a desktop app IMO, the developers that want extra performance should read the manual and configure things.
- weberc2 8y agoI’ve never heard of a runtime that forces a dichotomy between end-user- and developer-friendliness (putting aside for the moment that end users are famously annoyed by the Java runtime). Rust, Go, etc don’t have runtimes which force a choice between end-users and developers...
- simion314 8y agoJVM can be used for Desktop, server and in the past applets , it would be impossible to find a configuration that is optimal for all applications, so competent developers would tweak the defaults or use different deployment methods like AOT compilation or bundle your own JVM , is your problem that JVM is used in so many different places that different algorithms, runtimes and optimization were created for it ? Your examples of Go and Rust are of languages that are so far not been used in such diverse places, there are no good alternative compilers but something like Python has such a diversity of runtimes.
- Go0the0gophers 8y agoOr thread pool size...
- pjmlp 8y agoHardly any different that having to use VTune or perf to optimise C and C++, which require the added steps of recompiling with different flags and redemploying.
- weberc2 8y agoI wouldn’t recommend C or C++, but in their defense, you don’t need to worry about tuning as soon as you do on the JVM. Many apps won’t need to bother with it at all (which is good because C/C++ programmers have all manner of other things to worry about that aren’t a concern for modern languages).
- pjmlp 8y agoMe neither, I do like Rust and see its adoption at NPM as good PR for the language, however I also think that the way the decision process went wasn't free of bias.
- phamilton 8y agoThere's also a notion of failure mode for improperly tuned apps. This is certainly a personal preference, but I prefer true failures over constraint failures. I'd rather OOM in golang than run out of threads in my Java execution context while having plenty of free memory. At least when starting out.
- twic 8y agoHow much is that actually necessary these days? I remember spending ages tweaking flags in the 1.4 - 1.6 years. But there have increasingly been sensible defaults with broad applicability. Now that G1 is both default and usable, even more so. As i've moved onto 11, i've slashed our apps' JAVA_OPTS down to almost nothing - max heap size, some GC logging flags, that's it.
- swiftcoder 8y agoAt scale? Very necessary. The default GC as of Java 8 (the last version I used in production) suffered significant performance issues above 40 GB of working set, and required careful tuning thereafter.
- lllr_finger 8y agoI completely agree. The JVM is fine until it isn't, and at that point it becomes very frustrating to deal with - even when using less than 16GB RAM.
- pjmlp 8y agoThe default GC as of OpenJDK 8. The default GC from IBM, Azul, and others wasn't the same one. In fact Azul has made a business of selling JVMs with GC that can handle hundreds of data GBs. Modern OpenJDK versions also have such GCs now.
- jrs95 8y agoYeah. I can see the Java issue as a minor annoyance, but to put it on the same level as the lack of safety with C/C++ seems hyperbolic to me.
- sheeshkebab 8y agoDeploying jvm app/service is now even more complex than figuring out which version of node to use to run a service. Is it supposed to be oracle java? Openjdk? Adoptopenjdk or one of a half dozen more? Which version of it? Anything to tweak in gc or startup settings for it/the version? Do we need to regression test the service on minor jdk upgrade? Is that jvm compatible with some os version we are running that has some security patches and other settings?
- pjmlp 8y agoIt is pretty clear to any regular Java developer that bothers to keep up with the news. Regression tests are required for any toolchain.
- zaphar 8y agoYou are making the parents point for them.
- sgift 8y ago> Deploying jvm app/service is now even more complex than figuring out which version of node to use to run a service. > Is it supposed to be oracle java? Openjdk? Adoptopenjdk or one of a half dozen more? Which version of it? All of these must have been tested against the Java TCK. So, the answer is "whichever you/your company decided is okay" for the first part and for the second part "newest update of the Java version your software runs on". Doesn't sound very complex to me.
- bloopernova 8y agoWell, speaking from experience with a JBoss application layer in a recent software project I worked on: New java versions do break existing libraries or apps, and need to be tested thoroughly. When the company hasn't budgeted for that expense, it becomes difficult to update. Often an architect or software team will insist on using the Oracle JVM rather than the included openjvm. That adds extra steps to download, store as an artifact, distribute, verify, etc etc. The people who wrote the build pipeline have since been laid off, and an updated set of libraries requires a lot of work to trace back through poorly documented and understood code to make changes. (Not to disagree with you here, it's more that I'm trying to illustrate how, with poor foresight, Java dependencies can get difficult to manage)
- tzjmetron 8y agoNot convincing enough.
- paulddraper 8y ago> New java versions do break existing libraries or apps Have you used the Rust compiler? My experience tells me that any Github Rust project not updated in the last two years doesn't work with my Rust compiler. Whereas Java apps written a decade ago still compile and run on OpenJDK/Oracle often with zero or near zero changes. > Often an architect or software team will insist on using the Oracle JVM rather than the included openjvm. Yes, you could choose this. But if you have the ability to choose an entirely different language, I guarantee you have to ability to choose OpenJDK if that's what you really want. > build pipeline , an updated set of libraries Doesn't Rust have libraries? In fact, if anything, Java libraries have a longer shelf life and greater compatibility because they don't require integration of build systems. Java libraries can (and do) use 5-year-old compilers, postprocess bytecode for perf (e.g. Hikari) or size (e.g. Proguard), and even use entire other languages like Scala and Kotlin. But the only thing you as the library user need is the JVM bytecode, which is still high-level enough to maintain runtime interoperability but sufficiently low-level enough to achieve strong build-time interoperability. --- Much of the "organizational overhead" seems to come down to "I don't like managing the runtime". And that's not wrong; static binaries are nice. But how much harder is it really to manage/isolate/version your JVM runtime for your server deployment, than manage/isolate/version your Rust compiler for your CI pipeline?
- tyingq 8y agoI just like that someone at npm would avoid something because it has lots of dependencies and overhead. The irony is strong with this one.
- oconnor663 8y agoOn the other hand, NPM itself kind of paved the way for ecosystems with tons of dependencies, managed and versioned with a single tool. Installing system software like the JVM is more old school.
- derefr 8y agoNot so ironic—just because a practice is common among the median engineer in an ecosystem, doesn’t mean it will be common among the most experienced engineers in that ecosystem. Node gets a bad rap mostly for the fact that it has tons and tons of inexperienced engineers using it (probably as one of their first programming languages.) Same reason PHP got a bad rap back when. You can build solid software in both, by finding and absorbing engineering best-practices from people who have already had hard-fought battles to learn them; but an engineer will have to be burned at least once on building/scaling+SLAing something before they start looking for those. You might say that the Node ecosystem has a lot of programmers that are “engineering virgins”—they’ve never been forced to contend with the real problems of engineering software. But they’d be “engineering virgins” no matter what language they’re using; that’s not an indictment of the language, just a consequence of its popularity and approachability.
- icebraining 8y ago
- vbezhenar 8y agoI just unpack JDK, I have no idea what so complex about it. It was complex on Windows because I used VM to install Java and then copy folder, but they made it easier with 11.
- tyingq 8y agoOne example might be that if you unpacked the Oracle JDK, you owe Oracle a non-trivial amount of money now.
- pjmlp 8y agoOnly if deployed in production, and there's nothing hard to understand it.
- tyingq 8y agoCommercial development or test use isn't free. It's only free for personal, noncommercial use. So I'd argue it isn't so easy to understand.
- pjmlp 8y agoHow it isn't? You just explained it quite well. Not to mention that the Web is now full of discussions around this, with official posts from Oracle, Red-Hat, Amazon, IBM, Azul, Microsoft explaining how to go forward.
- tyingq 8y agoFigure out what you would pay if you used it in an elastic ECS setup. Using only Oracle documentation as a guide :)
- pjmlp 8y agoWhy should I? There is OpenJDK for that. But assuming that Oracle support is actually desired, here is what you are asking for. https://www.oracle.com/technetwork/java/java-se-support-roadmap.html https://www.oracle.com/technetwork/java/java-se-support-road... https://www.oracle.com/java/java-se-subscription.html https://www.oracle.com/java/java-se-subscription.html https://shop.oracle.com/apex/f?p=DSTORE:2:::NO:RIR,RP,2:PROD_HIER_ID:123775488249871532594385 https://shop.oracle.com/apex/f?p=DSTORE:2:::NO:RIR,RP,2:PROD... Old Java dog here. But lets just forget about the efforts from AdoptaJDK, Red-Hat, Amazon, Azul and bash Oracle, it is more fun.
- strictfp 8y agoTo me it reads as "We didn't want to use Java".
- tzjmetron 8y agoAgreed.
- oweiler 8y agoAlso with GraalVM you may get away with building a native image which doesn't require a JVM at all.
- rmrfrmrf 8y agoI'm not a fan of relying on distro package managers for installation of runtime dependencies on servers. Too many opportunites for variables to creep in if the version isn't locked, and then having to make sure all the package manager dependencies and config themselves. Even if you automate you're still at the mercy of the repo to have the version you need etc. and often times you need to customize the install for a highly-available and/or virtualized environment. Bad times all around.
- shaklee3 8y agoWhat's the alternative? Not installing the dependencies so the app doesn't work?
- ricardobeat 8y agoUsing the language package manager - npm, cargo, etc.
- rmrfrmrf 8y agoLots of options: containerization, downloading prebuilt binaries, downloading and building from source, or downloading, building, then packaging the artifacts and leaving somewhere centralized for deploy.
- koolba 8y agoThe alternative is vendoring the dependencies. That includes the JDK or Node runtime. With “modern” deployments you’ll see this with container based packaging that includes the runtimes either explicitly or via system packaged (in the container). The classic approach is copy the runtimes into your final application tarball. Either way the runtime is baked into the app and gets deployed and tested with it as a core component. Runtime upgrades then become vanilla deployments.
- brown9-2 8y agoIt reads like an innocent misperception due to inexperience with Java. Very few people would choose to install libraries (JARs) used by their code via their OS package manager for instance.
- paulddraper 8y agoYeah, "npmjs.com" would have been more enlightening.
- GordonS 8y agoThe issue with the JVM is keeping it updated, in the context of a constant stream of security issues that need patching.