4 ms·

I'm a developer, but I'm also on-call 24/7 for a Node.js application. The number of people here saying "this is why you don't use dependencies" or "this is why

I'm a developer, but I'm also on-call 24/7 for a Node.js application. The number of people here saying "this is why you don't use dependencies" or "this is why you vendor your deps" is frustrating to see. No one _but no one_ who has managed complex enough systems will jump on the bandwagon of enterprise-ready, monolithic and supported over something like Node.js. I'd trade in my JavaScript for J2EE about as fast as I'd quit tech and move up into the mountains. There are trade-offs, absolutely. Waiting on a vendor to fix a problem _for months_, while sending them hefty checks, is far inferior to waiting 3 hours on a Saturday for a fix, where the actual issue only effects new installations of a CLI tool used by developers, and can trivial be sidestepped. If anything, it's a chance to teach my developers about dep management! I'm positive my stack includes `is-promise` about 10 times. And I have no problem with that. If you upgrade deps (or don't) in any language, and don't have robust testing in place, the sysadmin in me hates you - I've seen it in everything from Go to PHP. There is no silver bullet except pragmatism!

sosodev 7y ago
There’s no silver bullet you’re absolutely right, but does that mean there isn’t room for improvement? Or that you shouldn’t try? Dropping all dependencies is extreme for sure but to argue against something as simple as vendoring is a bit odd.
- erulabs 7y ago
  You’re correct - there is room for improvement. The “npx” tool is a easy place to start! And absolutely agreed dropping dependencies is extreme and vendoring not so much - but in my experience vendoring often means “don’t ever touch again until a bad security shows up”. I was being a little bit too snarky in my comment tho, absolutely :)
- lmm 7y ago
  Vendoring causes more problems than it solves. There are plenty of things that could be improved about the node ecosystem, but a lot of the criticism isn't based on logic; there seems to be a large population on HN who just inherently hate large numbers of dependencies and will grasp for any excuse to justify that hate.
hitekker 7y ago
> I'd trade in my JavaScript for J2EE about as fast as I'd quit tech and move up into the mountains. I think the snark is obscuring the point of this comment.
dylan604 7y ago
>I'd trade in my JavaScript for J2EE about as fast as I'd quit tech and move up into the mountains. Sadly, I dream of doing this very thing every day. I'm at that notch on the thermometer just before "burned out". I love creating a working app from scratch. However, I'm so sick of today's tech. The app stores are full of useless apps that look like the majority of other apps whose sole purpose is to gather the user's personal data for monetizing. The web is also broken with other variations of constant tracking. I'm of an age where I remember time before the internet, so I'm not as addicted as younger people.
- erulabs 7y ago
  Send me a message if you want - I'd love to share what I'm building with you, as it is intended to resolve that exact feeling. I sympathize entirely.
  - dylan604 7y ago
    If it's a log cabin, just tell me where to be, and I'll show up with hammers and saws!
jasonhansel 7y ago
Sure, but JavaScript and J2EE aren't the only options. You can use a language with more built-in functionality, reduce the use of unnecessary external libraries, and/or limit those libraries to ones from trusted sources.
ashtonkem 7y ago
Funny, I run an “enterprise” stack almost entirely made of Java. I wouldn’t trade it for NodeJS for the world. Making upstream changes indeed would be very, very hard. But I never have to make upstream changes because they’ve spent quite a large amount of effort on stability.
- foepys 7y ago
  I'm also making enterprise-grade software with quite a few external dependencies. I had to email the developers of the biggest dependency multiple times because of bugs but they were all fixed within a few weeks in a new patch release. They also went out of their way to provide me with workarounds for my problems. In the NPM world you are on your own.
  - _-o-_ 7y ago
    Why? You can email package maintainer just as well, or better yet - open an issue on GitHub.
renw0rp 7y ago
J2ee was a hell, but Java EE was quite decent! Pragmatism - do programming to solve real life problems rather than create a broken ecosystems which requires constant changes (and learning just to be on top of them) to fix a bad design
balfirevic 7y ago
I honestly have no idea if you prefer Node.js or J2EE after reading this comment.
- hombre_fatal 7y ago
  They mean that they would only trade Node.js for J2EE the day they can also quit (so that they don't have to use J2EE).

sosodev 7y ago

There’s no silver bullet you’re absolutely right, but does that mean there isn’t room for improvement? Or that you shouldn’t try? Dropping all dependencies is extreme for sure but to argue against something as simple as vendoring is a bit odd.

erulabs 7y ago
You’re correct - there is room for improvement. The “npx” tool is a easy place to start! And absolutely agreed dropping dependencies is extreme and vendoring not so much - but in my experience vendoring often means “don’t ever touch again until a bad security shows up”. I was being a little bit too snarky in my comment tho, absolutely :)
lmm 7y ago
Vendoring causes more problems than it solves. There are plenty of things that could be improved about the node ecosystem, but a lot of the criticism isn't based on logic; there seems to be a large population on HN who just inherently hate large numbers of dependencies and will grasp for any excuse to justify that hate.

hitekker 7y ago

> I'd trade in my JavaScript for J2EE about as fast as I'd quit tech and move up into the mountains. I think the snark is obscuring the point of this comment.

dylan604 7y ago

>I'd trade in my JavaScript for J2EE about as fast as I'd quit tech and move up into the mountains. Sadly, I dream of doing this very thing every day. I'm at that notch on the thermometer just before "burned out". I love creating a working app from scratch. However, I'm so sick of today's tech. The app stores are full of useless apps that look like the majority of other apps whose sole purpose is to gather the user's personal data for monetizing. The web is also broken with other variations of constant tracking. I'm of an age where I remember time before the internet, so I'm not as addicted as younger people.

erulabs 7y ago
Send me a message if you want - I'd love to share what I'm building with you, as it is intended to resolve that exact feeling. I sympathize entirely.
- dylan604 7y ago
  If it's a log cabin, just tell me where to be, and I'll show up with hammers and saws!

jasonhansel 7y ago

Sure, but JavaScript and J2EE aren't the only options. You can use a language with more built-in functionality, reduce the use of unnecessary external libraries, and/or limit those libraries to ones from trusted sources.

ashtonkem 7y ago

Funny, I run an “enterprise” stack almost entirely made of Java. I wouldn’t trade it for NodeJS for the world. Making upstream changes indeed would be very, very hard. But I never have to make upstream changes because they’ve spent quite a large amount of effort on stability.

foepys 7y ago
I'm also making enterprise-grade software with quite a few external dependencies. I had to email the developers of the biggest dependency multiple times because of bugs but they were all fixed within a few weeks in a new patch release. They also went out of their way to provide me with workarounds for my problems. In the NPM world you are on your own.
- _-o-_ 7y ago
  Why? You can email package maintainer just as well, or better yet - open an issue on GitHub.

renw0rp 7y ago

J2ee was a hell, but Java EE was quite decent! Pragmatism - do programming to solve real life problems rather than create a broken ecosystems which requires constant changes (and learning just to be on top of them) to fix a bad design

balfirevic 7y ago

I honestly have no idea if you prefer Node.js or J2EE after reading this comment.

hombre_fatal 7y ago
They mean that they would only trade Node.js for J2EE the day they can also quit (so that they don't have to use J2EE).