3 ms·
I’m not sure whataboutism is the way to fix the well-known issues the JS ecosystem has in package management. When I’ve installed a Go package or Python package
by bsagdiyev 7y ago
I’m not sure whataboutism is the way to fix the well-known issues the JS ecosystem has in package management. When I’ve installed a Go package or Python package I haven’t ended up with sometimes hundreds or thousands of sub-dependencies. Some packages can be ridiculous, but nothing like I have seen running “npm i” for something that seems like it should be simple. I apologize for not having an example off-hand but this keeps coming up precisely because it is an issue unique to JS in this case, even if other languages have it to a degree.
- sippeangelo 7y agoTry Feathers, a "lightweight web-framework for creating real-time applications and REST APIs" clocking in at about 600 transitive dependencies. How do you audit this?
- bsagdiyev 7y agoLink for the curious: https://github.com/feathersjs/feathers https://github.com/feathersjs/feathers
- jfkebwjsbx 7y agoI think they just don't audit nor review the code they depend on.
- dmitriid 7y agoIt's now whataboutism. It's finger pointing from a lot of people who develop in languages whose story is only marginally better. As I wrote in a sibling comment, I have a project I haven't even started yet in Rust [1]. And it's measly 6 dependencies pull a total of 197. [1] https://news.ycombinator.com/item?id=22841742 https://news.ycombinator.com/item?id=22841742
- bsagdiyev 7y agoI took a look, this sounds more unique to Rust than Go or Python, but they all can do it to some degree. I have no hands on experience with Rust to really have any reasonable input on this so I don’t want to make an uninformed statement.
- jfkebwjsbx 7y agoIf what you say is true, then Rust is suffering the same fate. 197 dependencies is too many to trust.