4 ms·

Before "tree shaking" I stored all npm modules in SCM and reviwed all updates as I had to commit after "npm update". I also put ton of files in .ignore as 90% o

by z3t4 7y ago

Before "tree shaking" I stored all npm modules in SCM and reviwed all updates as I had to commit after "npm update". I also put ton of files in .ignore as 90% of files in some packages are not required. I also used to include npm modules in distribution/deployment. So my request to npm is to add an option in the main package.json to disable tree shaking.

kreetx 7y ago
I evaluated wordpress plugins this way, a good way to check if something strange had crept in. By the ignored files do you mean non-code?
- z3t4 7y ago
  Take the most popular npm module lodash for example. It has over one thousand files! But you probably only need one (lodash.js) and that's the one I would commit to SCM.
- aspaceman 7y ago
  I think they mean code - just remove all files that your program doesn't touch. With something like JS, this should be doable in cases because of the way libraries tend to be designed. The equivalent in a compiled language would be to strip unused symbols from the binary.
robocat 7y ago
I wish there was a way to "bless" packages when they were reviewed. I want a network of trust, such that a Google reviewed package is worth 10 points, a package fuzzed by foobar is worth 2 points, something skimmed by a dependant user is worth 1 point etc. I can then chose a compromise between a highly rated/reviewed dependencies and functionality/risk/cost-to-review. My own blessing of a package I have reviewed might become a very small signal in a web of trust.
- MaulingMonkey 7y ago
  For Rust there is at least one tool for this that I've started using, although I don't think it's very widely used: https://github.com/dpc/crev/tree/master/cargo-crev https://github.com/dpc/crev/tree/master/cargo-crev Ironically this depends on a whole slew of additional packages I haven't yet reviewed to build ;) Very recently (2 commits starting 8 days ago) someone started on an npm equivalent but it's not in a usable state yet: https://github.com/kspaans/npm-crev/blob/master/TODO.md https://github.com/kspaans/npm-crev/blob/master/TODO.md Two problems - few people out there reviewing code, and poor discoverability for who else is reviewing code that you might trust at the moment.
- yaa_minu 7y ago
  You may find npms.io[1] useful. For each package, they provide a score on maintainability, popularity and quality. [1] https://npms.io https://npms.io
  - bauerd 7y ago
    npms.io rates the `rate-map` package with quality 99%, so not sure how helpful that is
- eitland 7y ago
  Interesting! I thibk this is a good start but I guess it would still need some thought to be resistant to sybil attacks. BTW: I used to think the dependencies that came as part of for example the official Angular packages where vetted. Can anyone confirm or deny this? Anyone can
- dentemple 7y ago
  I would not at all trust a "Google" reviewed package, not for their penchant privacy violations and writing code to fuel them.
  - ivanfon 7y ago
    I assume the idea is that, even if Google violates their user’s privacy, they take care not to let others violate their user’s privacy through their dependencies.

by z3t4 7y ago

kreetx 7y ago

I evaluated wordpress plugins this way, a good way to check if something strange had crept in. By the ignored files do you mean non-code?

z3t4 7y ago
Take the most popular npm module lodash for example. It has over one thousand files! But you probably only need one (lodash.js) and that's the one I would commit to SCM.
aspaceman 7y ago
I think they mean code - just remove all files that your program doesn't touch. With something like JS, this should be doable in cases because of the way libraries tend to be designed. The equivalent in a compiled language would be to strip unused symbols from the binary.

robocat 7y ago

I wish there was a way to "bless" packages when they were reviewed. I want a network of trust, such that a Google reviewed package is worth 10 points, a package fuzzed by foobar is worth 2 points, something skimmed by a dependant user is worth 1 point etc. I can then chose a compromise between a highly rated/reviewed dependencies and functionality/risk/cost-to-review. My own blessing of a package I have reviewed might become a very small signal in a web of trust.

MaulingMonkey 7y ago
For Rust there is at least one tool for this that I've started using, although I don't think it's very widely used: https://github.com/dpc/crev/tree/master/cargo-crev https://github.com/dpc/crev/tree/master/cargo-crev Ironically this depends on a whole slew of additional packages I haven't yet reviewed to build ;) Very recently (2 commits starting 8 days ago) someone started on an npm equivalent but it's not in a usable state yet: https://github.com/kspaans/npm-crev/blob/master/TODO.md https://github.com/kspaans/npm-crev/blob/master/TODO.md Two problems - few people out there reviewing code, and poor discoverability for who else is reviewing code that you might trust at the moment.
yaa_minu 7y ago
You may find npms.io[1] useful. For each package, they provide a score on maintainability, popularity and quality. [1] https://npms.io https://npms.io
- bauerd 7y ago
  npms.io rates the `rate-map` package with quality 99%, so not sure how helpful that is
eitland 7y ago
Interesting! I thibk this is a good start but I guess it would still need some thought to be resistant to sybil attacks. BTW: I used to think the dependencies that came as part of for example the official Angular packages where vetted. Can anyone confirm or deny this? Anyone can
dentemple 7y ago
I would not at all trust a "Google" reviewed package, not for their penchant privacy violations and writing code to fuel them.
- ivanfon 7y ago
  I assume the idea is that, even if Google violates their user’s privacy, they take care not to let others violate their user’s privacy through their dependencies.