6 ms·

That's the hidden cost of npm, cargo, pip, et. Al. The other one is IMO akin to overweight. Try to modernize a mid-sized project after one or two years and cry

That's the hidden cost of npm, cargo, pip, et. Al. The other one is IMO akin to overweight. Try to modernize a mid-sized project after one or two years and cry when you see the dependency graph. Ceterum censeo go inferior est.

atoav 7y ago
That is exactly why I always ask myself: Do I really need dependency X? Because that dependency might itself have dependencies and this quickly grows out if hand with different versions etc. It might work now, but will it in the future? How many different versions of the same package do I really need to depend on?
pbhjpbhj 7y ago
>Ceterum censeo go inferior est. AFAICT this means something like "furthermore, I opine that Go[lang] is inadequate". It's some weird reference to an ancient Roman who always went on about destroying Carthage ("Carthago delenda est"). You, choeger, get the award for "weird reference I bothered to chase up". Aside, I wonder if PM Johnson (a Classics scholar) had this in mind when his handlers instructed him to mimic Trump's rhetorical technique of "ignore the question just brainwash the suckers into associating you with this 3-word phrase".
- valvar 7y ago
  I'm not sure if you are being ironic or not, but Cato the Elder is an extremely famous roman figure. I think most educated people, especially on HN, are familiar with his most famous phrase even if it is not in the most common formulation.
  - squiggleblaz 7y ago
    Well I've heard of him. But I suspect you greatly overestimate the importance of dead Romans to contemporary programmers. It is no doubt possible to be a good, English speaking programmer, without knowing anything much about the Roman empire and its inhabitants, if you come from the east Asia for instance. Even for those from the West, there are cultures which do not rate Ancient Rome as so significant that it is necessary for an educated person to be familiar with Cato the Elder's most famous phrase, whatever it may be.
  - cannam 7y ago
    > are familiar with his most famous phrase In some cases, possibly, via Asterix: https://www.everythingasterix.com/latin-jokes-content/2015/4/17/asterix-and-the-laurel-wreath-latin-jokes-explained https://www.everythingasterix.com/latin-jokes-content/2015/4...
lifthrasiir 7y ago
If you define the "modernization" as mindlessly switching to a trending framework or library, the cost is inevitable even without package managers.
- squiggleblaz 7y ago
  You don't need to mindlessly switch to a trending framework or library. Try upgrading typescript to the latest version. I think that's a fair definition of "modernisation" and something which should be benign. But now all of a sudden you have to upgrade every dependency to the latest version - or write your own .d.ts files - since they're typically written to the current library version - typescript version combination.
  - gpm 7y ago
    The rust eco system has done a pretty good job at this. The language and standard library is always backwards compatible (minor security fixes excepted). So updating to a newer language version just works. Major libraries at the roots of many dependency trees have upgraded in backwards incompatible ways a few times, but the community has pretty consistently come together and helped move every other library that anyone uses to the new version.
- choeger 7y ago
  I define modernization as anything from updating frameworks, over libraries, tools, to the language itself.
anotherevan 7y ago
Quidquid latine dictum sit, altum videtur.
adgasf 7y ago
Presumably you need some functionality in the dependencies that you use. If you don't use a package manager then your options are: * Import the dependency manually. This is taking a dependency without the formal description a package manager gives you, making it harder to audit, update etc. * Write the functionality yourself. This guarantees you are not exposed to malicious code, but it takes time and your solution will likely have more bugs than a widely used solution. You also lose the ability to use other dependencies that build on top (e.g. React components) because you are now outside the mainstream. What is actually needed is better tooling to analyze and prune dependency graphs.
gpvos 7y ago
> Ceterum censeo go inferior est. Cur?
- choeger 7y ago
  Because it did not even bother with a powerful and useful type system. Counter example: Rust. I don't think go would be a thing if rust was, say, two years older than it is.

atoav 7y ago

That is exactly why I always ask myself: Do I really need dependency X? Because that dependency might itself have dependencies and this quickly grows out if hand with different versions etc. It might work now, but will it in the future? How many different versions of the same package do I really need to depend on?

pbhjpbhj 7y ago

>Ceterum censeo go inferior est. AFAICT this means something like "furthermore, I opine that Go[lang] is inadequate". It's some weird reference to an ancient Roman who always went on about destroying Carthage ("Carthago delenda est"). You, choeger, get the award for "weird reference I bothered to chase up". Aside, I wonder if PM Johnson (a Classics scholar) had this in mind when his handlers instructed him to mimic Trump's rhetorical technique of "ignore the question just brainwash the suckers into associating you with this 3-word phrase".

valvar 7y ago
I'm not sure if you are being ironic or not, but Cato the Elder is an extremely famous roman figure. I think most educated people, especially on HN, are familiar with his most famous phrase even if it is not in the most common formulation.
- squiggleblaz 7y ago
  Well I've heard of him. But I suspect you greatly overestimate the importance of dead Romans to contemporary programmers. It is no doubt possible to be a good, English speaking programmer, without knowing anything much about the Roman empire and its inhabitants, if you come from the east Asia for instance. Even for those from the West, there are cultures which do not rate Ancient Rome as so significant that it is necessary for an educated person to be familiar with Cato the Elder's most famous phrase, whatever it may be.
- cannam 7y ago
  > are familiar with his most famous phrase In some cases, possibly, via Asterix: https://www.everythingasterix.com/latin-jokes-content/2015/4/17/asterix-and-the-laurel-wreath-latin-jokes-explained https://www.everythingasterix.com/latin-jokes-content/2015/4...

lifthrasiir 7y ago

If you define the "modernization" as mindlessly switching to a trending framework or library, the cost is inevitable even without package managers.

squiggleblaz 7y ago
You don't need to mindlessly switch to a trending framework or library. Try upgrading typescript to the latest version. I think that's a fair definition of "modernisation" and something which should be benign. But now all of a sudden you have to upgrade every dependency to the latest version - or write your own .d.ts files - since they're typically written to the current library version - typescript version combination.
- gpm 7y ago
  The rust eco system has done a pretty good job at this. The language and standard library is always backwards compatible (minor security fixes excepted). So updating to a newer language version just works. Major libraries at the roots of many dependency trees have upgraded in backwards incompatible ways a few times, but the community has pretty consistently come together and helped move every other library that anyone uses to the new version.
choeger 7y ago
I define modernization as anything from updating frameworks, over libraries, tools, to the language itself.

anotherevan 7y ago

Quidquid latine dictum sit, altum videtur.

adgasf 7y ago

Presumably you need some functionality in the dependencies that you use. If you don't use a package manager then your options are: * Import the dependency manually. This is taking a dependency without the formal description a package manager gives you, making it harder to audit, update etc. * Write the functionality yourself. This guarantees you are not exposed to malicious code, but it takes time and your solution will likely have more bugs than a widely used solution. You also lose the ability to use other dependencies that build on top (e.g. React components) because you are now outside the mainstream. What is actually needed is better tooling to analyze and prune dependency graphs.

gpvos 7y ago

> Ceterum censeo go inferior est. Cur?

choeger 7y ago
Because it did not even bother with a powerful and useful type system. Counter example: Rust. I don't think go would be a thing if rust was, say, two years older than it is.