3 ms·

Can you please explain how APT limits freedom?

roryrjb 7y ago
I take it to mean that with npm there is a very low barrier for entry. I mean it's not difficult to actually host an apt repo on your own server or on S3, but there's still more you need to know to get to that stage. I personally think that using something like apt for Node.js dependencies is a very good idea. I work with Node at work and on the side, and my/our usual stack is either Debian or Ubuntu. Even when Docker gets involved it's usually a Debian or Debian based image. [Edit: phrasing]
- kostarelo 7y ago
  I am trying to understand why we make NPM such a big deal (and suddenly have all these projects born to solve the NPM problem) when people have solve the issue of a package repository already. C j Silverio's point (JSConf's talk [1]) was that is NPM's scale that makes it hard. Refs: 1: https://www.youtube.com/watch?v=MO8hZlgK5zc https://www.youtube.com/watch?v=MO8hZlgK5zc
  - steveklabnik 7y ago
    To put some perspective on this, comparing Debian to npm: Number of packages: Debian has 172,000 packages for the most popular architecture, amd64. i386 has 24,000 packages. The rest have less than 500 each. npm recently broke a million packages. Download counts: I couldn't find numbers for Debian. npm served 11.2 billion downloads last week. (Debian numbers retrieved by https://popcon.debian.org/ https://popcon.debian.org/, npm numbers from https://medium.com/npm-inc/npm-weekly-200-dont-miss-today-s-tech-talk-1-million-packages-plus-learn-how-npm-s-security-f75f9882aebe https://medium.com/npm-inc/npm-weekly-200-dont-miss-today-s-... and https://api.npmjs.org/downloads/point/last-week https://api.npmjs.org/downloads/point/last-week
    - ricardobeat 7y ago
      Partially self-inflicted since a normal JS project will redownload the same packages over and over again, hundreds of times throughout their existence.
    - regularfry 7y ago
      Debian also has a repository model which allows the packages to be served by a static file server, because the dependency resolution is entirely client-side. Npm doesn't.
      - steveklabnik 7y ago
        Hm, as far as I know, resolution is also entirely client-side for npm. Do you have any links about this?
Lowkeyloki 7y ago
I think it only limits "freedom" in that it only makes sense on Debian-based operating systems. Whereas I can and do run npm on tons of different Linux distributions, MacOS, and (theoretically) Windows. You can do things with deb packages on other Linux distributions kinda-sorta using various programs and scripts, but it's not painless. And Mac and Windows are right out. The same applies generally as to why there are usually two types of dependency managers. One for binary packages and binary shared libraries (even though these often include source code for C & C++ stuff), and one for specific language development environments. See also Rust, Dart, Python, Ruby, Go, Lua, etc., etc. All those languages have their own package managers.
eeZah7Ux 7y ago
By default it does not allow to distribute and install multiple versions of the same library, and for good reasons.

I take it to mean that with npm there is a very low barrier for entry. I mean it's not difficult to actually host an apt repo on your own server or on S3, but there's still more you need to know to get to that stage. I personally think that using something like apt for Node.js dependencies is a very good idea. I work with Node at work and on the side, and my/our usual stack is either Debian or Ubuntu. Even when Docker gets involved it's usually a Debian or Debian based image. [Edit: phrasing]

kostarelo 7y ago
I am trying to understand why we make NPM such a big deal (and suddenly have all these projects born to solve the NPM problem) when people have solve the issue of a package repository already. C j Silverio's point (JSConf's talk [1]) was that is NPM's scale that makes it hard. Refs: 1: https://www.youtube.com/watch?v=MO8hZlgK5zc https://www.youtube.com/watch?v=MO8hZlgK5zc
- steveklabnik 7y ago
  To put some perspective on this, comparing Debian to npm: Number of packages: Debian has 172,000 packages for the most popular architecture, amd64. i386 has 24,000 packages. The rest have less than 500 each. npm recently broke a million packages. Download counts: I couldn't find numbers for Debian. npm served 11.2 billion downloads last week. (Debian numbers retrieved by https://popcon.debian.org/ https://popcon.debian.org/, npm numbers from https://medium.com/npm-inc/npm-weekly-200-dont-miss-today-s-tech-talk-1-million-packages-plus-learn-how-npm-s-security-f75f9882aebe https://medium.com/npm-inc/npm-weekly-200-dont-miss-today-s-... and https://api.npmjs.org/downloads/point/last-week https://api.npmjs.org/downloads/point/last-week
  - ricardobeat 7y ago
    Partially self-inflicted since a normal JS project will redownload the same packages over and over again, hundreds of times throughout their existence.
  - regularfry 7y ago
    Debian also has a repository model which allows the packages to be served by a static file server, because the dependency resolution is entirely client-side. Npm doesn't.
    - steveklabnik 7y ago
      Hm, as far as I know, resolution is also entirely client-side for npm. Do you have any links about this?

Lowkeyloki 7y ago

I think it only limits "freedom" in that it only makes sense on Debian-based operating systems. Whereas I can and do run npm on tons of different Linux distributions, MacOS, and (theoretically) Windows. You can do things with deb packages on other Linux distributions kinda-sorta using various programs and scripts, but it's not painless. And Mac and Windows are right out. The same applies generally as to why there are usually two types of dependency managers. One for binary packages and binary shared libraries (even though these often include source code for C & C++ stuff), and one for specific language development environments. See also Rust, Dart, Python, Ruby, Go, Lua, etc., etc. All those languages have their own package managers.

eeZah7Ux 7y ago

By default it does not allow to distribute and install multiple versions of the same library, and for good reasons.