6 ms·
This is a good thing. When they were independent, NPM was a disaster area. The company spent 100% of its time chasing down social issues and insanity in the com
by VonGuard 6y ago
This is a good thing. When they were independent, NPM was a disaster area. The company spent 100% of its time chasing down social issues and insanity in the community and never figured out how to make money, or at least, it took them FOREVER to figure that out.
Years ago, they introduced "orgs" which they sat there and explained to me with slides and pictures and concepts and business bullshit for an hour. I did not understand a thing they'd said. Finally, they were like "We're selling private namespace in the npm registry for blessed packages for groups or businesses." I understood that. If they'd just said that up front....
They had some great people, some very smart folks like CJ, but they completely biffed every business decision they ever made, and when you'd go in and talk to the leadership, they were always acting as if they had some sort of PTSD from the community. I mean, people were putting spam packages in NPM just to get SEO on some outside webpage through the default NPM package webpages. People were squatting and stealing package names. Leftpad... the community management here is nightmarishly hard, and I was never convinced they'd ever make money on it. MS doesn't NEED to make money on it. They can just pump in cash and have a brilliant tool for reaching UX developers around the world, regardless of whether they use Windows or not.
I feel like the GitHub group at Microsoft is now some sort of orphanage for mistreated developer tool startups. GitHub had similar management issues: they refused to build enterprise features at all for years unless they were useful to regular GitHub.com. And there were other people issues at the top for years. Chris seemed more interested in working with the Obama administration on digital learning initiatives than with running GitHub, for example.
- redthrowaway 6y agonpm is still a disaster, but for other reasons: $ time rm -rf node_modules/ real 1m2.969s user 0m0.409s sys 0m15.853s
- tracker1 6y agoAre you using a 5400rpm hdd? In an existing UI project repo... ci (which clears node_modules) then installs from lock... added 1880 packages in 23.283s real 0m24.073s user 0m0.000s sys 0m0.135s Still slower than I'd like... but I'm pretty judicious in terms of what I let come in regarding dependencies. That's react, redux, react-redux, material-ui, parcel (for webpack, babel, etc) and a few other dependencies. For one of the API packages ci over an existing install... added 1069 packages in 12.911s real 0m13.708s user 0m0.045s sys 0m0.076s So either you're including the kitchen sink, or you're running on a really slow drive.
- jatone 6y agothey're running a mac probably it takes forever to rm -rf a directory on macs vs linux.
- nhooyr 6y agoHave not had this experience. I find Macs to be faster in fact as the SSDs are normally much faster than most linux machines.
- byroot 6y agoThis isn't about SSD speed. Reading large file is comparable, but there is a very large overhead on the initial file access because of sandboxing. Opening (or deleting) an empty file is about 2.5x slower on OSX than on a Linux running in VirtualBox on that same Mac: https://discuss.rubyonrails.org/t/why-is-rails-boot-so-slow-on-macos/74021/19 https://discuss.rubyonrails.org/t/why-is-rails-boot-so-slow-...
- redthrowaway 6y agoYou called it. I didn't know OSX was bad for that though
- tracker1 6y agoMe either... Was using a hackintosh and rmbp until about 2 years ago, stopped using mac at work, and in october switched to a new desktop and jumped to linux. Been back in windows + wsl2 for a couple months now. Back using mac, and most of my windows until a couple months ago, was still mostly linux via VM. Guess I never realized how slow macos's file system was for deleting files. edit: Also, for those curious, WSL2 files in Windows is slow, and windows files in wsl are slow... each are fast in their own sandbox.
- redthrowaway 6y agoSSD on a 2018 MBP with an i7
- searchableguy 6y agoI just use yarn. V2 forces PNP by default which speeds up the installation by 2-3x. https://yarnpkg.com/features/pnp https://yarnpkg.com/features/pnp
- ex3ndr 6y agoYou are saying it is like you don't have to put JDK to your Dockerized java apps. (pick any language you want that is not statically compiled)
- redthrowaway 6y agoNothing dockerized locally. This is a bare bones NextJS front end. $ npm list --depth=0 <removed for opsec> ├── @babel/plugin-proposal-class-properties@7.8.3 ├── @babel/plugin-proposal-decorators@7.8.3 ├── @graphql-codegen/cli@1.13.2 extraneous ├── @graphql-codegen/core@1.13.2 ├── @graphql-codegen/typescript@1.13.2 ├── @graphql-codegen/typescript-graphql-request@1.13.2 ├── @graphql-codegen/typescript-operations@1.13.2 ├── @graphql-toolkit/core@0.10.3 ├── @graphql-toolkit/url-loader@0.10.3 ├── @types/lodash@4.14.149 ├── @types/node@13.11.1 ├── @types/react@16.9.34 ├── @types/reactstrap@8.4.2 ├── @zeit/next-css@1.0.1 ├── @zeit/next-sass@1.0.1 ├── babel-plugin-module-resolver@4.0.0 ├── bootstrap@4.4.1 ├── dotenv@8.2.0 ├── express@4.17.1 ├── UNMET PEER DEPENDENCY graphql@15.0.0 ├── graphql-request@1.8.2 ├── graphql-tag@2.10.3 ├── helmet@3.22.0 ├── isomorphic-unfetch@3.0.0 ├── UNMET PEER DEPENDENCY jquery@1.9.1 - 3 ├── lodash@4.17.15 ├── mobx@5.15.4 ├── mobx-react@6.1.8 ├── next@9.3.4 ├── next-fonts@1.0.3 ├── node-sass@4.13.1 ├── nodemon@2.0.2 ├── react@16.13.1 ├── react-dom@16.13.1 ├── reactstrap@8.4.1 ├── styled-components@5.0.1 ├── styled-icons@10.2.1 ├── ts-node@8.8.2 └── typescript@3.8.3
- ex3ndr 6y agoMy point is that to avoid node_modules in other libraries you just install dependencies globally with JDK or like
- gowld 6y agoIt's not a bad idea for MS to sponsor this stuff as a PR play, but it needs a strong commitment to ombudsing and community oversight, or it becomes just another Embrace/Extend/Extinguish.
- tomnipotent 6y agoIt's 2020, please stop bringing up E/E/E. That boat sailed long ago.
- orestarod 6y agoHow so?
- zozbot234 6y ago> I mean, people were putting spam packages in NPM just to get SEO on some outside webpage through the default NPM package webpages. People were squatting and stealing package names. Leftpad... the community management here is nightmarishly hard It's not NPM's fault (well, other than wrt. the leftpad thing), it's all about the "community". The Javascript open source community is a dumpster fire.
- VonGuard 6y agoCorrect, it is not their fault. But they ended up spending all their time on it, and in an unproductive manner, I feel.
- gedy 6y agoOh please... I’ve solved more customer needs and business value from this "dumpster fire" than I have with other "real languages" I've worked with in my career. Give it some credit.
- sarakayakomzin 6y agoI've worked with a lot of developers who have provided business value by importing leftpad rather than writing code.
- 411111111111111 6y agoWhat does your productivity in js have to do with js having a terrible community?
- emilsedgh 6y agoIt's the [terrible] community that provides so much value in form of npm, not that js is really that much more productive.
- thaumasiotes 6y agoThere's no contradiction between providing a ton of value and being horrible. You know how people ask "why do people stay in abusive marriages?"? That's why. On a bigger scale, this passage from The Early Chinese Empires: Qin and Han stuck with me: > Today, in a stretch of about 1,100 miles, the Yellow River moves along 11 yards above the plain. But dikes do not control silting, and floods continued to occur on an ever larger scale. On more than 1,500 occasions during the history of imperial China the Yellow River burst its dikes, destroying farmland, killing villagers, and earning its description as "China's sorrow".
- pjc50 6y ago> I feel like the GitHub group at Microsoft is now some sort of orphanage for mistreated developer tool startups. That seems .. not so bad really? Microsoft gets to buy them cheaply, and they don't get obliterated or acquihired, and they don't seem to have Yahoo'd them into slow death either.
- Cthulhu_ 6y agoThey could have made a LOT of money (I think) by offering a "secure" registry - only packages that were reviewed, verified and signed would end up in there, and they would be sealed and made available forever. Companies could have their developers use only that because there is still a huge risk of a malicious actor pushing a patch version of a library with a security vulnerability in it, and at the moment security is still a reactive action in the Node ecosystem.
- riyakhanna1983 6y agoWhat companies do you see paying for this service? Why would they prefer paying a company for this over a community-driven effort to curate secure packages.
- throwawaymanbot 6y agoin open source, is never figuring out how to make money, REALLY a priority? pfffft.