4 ms·

NPM is enough reason to not use javascript but I haven't touched javascript since introduction of typescript.

by netdur 7y ago

chrisco255 7y ago
Why? NPM is a fantastic package manager.
- TomMarius 7y ago
  But a disastrous registry
- yegle 7y ago
  NPM introduced a new type of code injection.
  - solarkraft 7y ago
    Could you explain the code injection vulnerabilities present in NPM that other package managers don't have?
    - c256 7y ago
      Not the OP, but my understanding is that the problem is a matter of practice: there are so many tiny packages with such complicated dependency graphs that the exposed surface for attacks is two steps past gigantic. As someone who doesn’t use much JS/npm, but who did work with dependency graphs in software systems in a former life, my (largely academic) study suggests that this is an intractable problem in npm — that is, a solution is such a big change from npm foundational usage that it’s far more likely to be solved with an npm replacement than an npm change. I would welcome sources that either refute or confirm this.
- microcolonel 7y ago
  The performance was poor enough for long enough (and continues to be, probably?) that more than one third party implementation came along to replace it. There's no real reason that NPM can't be as fast as Yarn, except that it isn't (or wasn't? I haven't used it for enough full-size projects lately that I would know whether or not it's gotten better).
leerob 7y ago
What are you using instead of JS for web development? If you really dislike NPM that much, GitHub might be here to save the day. https://github.com/features/package-registry https://github.com/features/package-registry
- netdur 7y ago
  Like I said, I'm using typed javascript (typescript) with some webassembly where it make sense, I am not trusting my own code without typings. I have absolute no idea how to fix package management for javascript, NPM has its own problems that long fixed by other package mangers for other languages, it been years NPM still broken.

NPM is enough reason to not use javascript but I haven't touched javascript since introduction of typescript.

by netdur 7y ago

NPM is enough reason to not use javascript but I haven't touched javascript since introduction of typescript.

chrisco255 7y ago

Why? NPM is a fantastic package manager.

TomMarius 7y ago
But a disastrous registry
yegle 7y ago
NPM introduced a new type of code injection.
- solarkraft 7y ago
  Could you explain the code injection vulnerabilities present in NPM that other package managers don't have?
  - c256 7y ago
    Not the OP, but my understanding is that the problem is a matter of practice: there are so many tiny packages with such complicated dependency graphs that the exposed surface for attacks is two steps past gigantic. As someone who doesn’t use much JS/npm, but who did work with dependency graphs in software systems in a former life, my (largely academic) study suggests that this is an intractable problem in npm — that is, a solution is such a big change from npm foundational usage that it’s far more likely to be solved with an npm replacement than an npm change. I would welcome sources that either refute or confirm this.
microcolonel 7y ago
The performance was poor enough for long enough (and continues to be, probably?) that more than one third party implementation came along to replace it. There's no real reason that NPM can't be as fast as Yarn, except that it isn't (or wasn't? I haven't used it for enough full-size projects lately that I would know whether or not it's gotten better).

leerob 7y ago

What are you using instead of JS for web development? If you really dislike NPM that much, GitHub might be here to save the day. https://github.com/features/package-registry https://github.com/features/package-registry

netdur 7y ago
Like I said, I'm using typed javascript (typescript) with some webassembly where it make sense, I am not trusting my own code without typings. I have absolute no idea how to fix package management for javascript, NPM has its own problems that long fixed by other package mangers for other languages, it been years NPM still broken.