14 ms·
The dependency management is highly questionable for me. Apart from the security concerns raised by others, I have huge concerns about availability. In it's cu
by bgdam 6y ago
The dependency management is highly questionable for me. Apart from the security concerns raised by others, I have huge concerns about availability.
In it's current form, I'd never run Deno on production, because dependencies have to be loaded remotely. I understand they are fetched once and cached, but that will not help me if I'm spinning up additional servers on demand. What if the website of one of the packages I depend on goes down, just as I have a huge spike in traffic?
Say what you want about Node's dependency management, but atleast I'm guaranteed reproducible builds, and the only SPOF is the NPM repositories, which I can easily get around by using one of the proxies.
- ryanseys 6y agoIt's just a URL right? So could you not mirror the packages to your own server if you're so concerned, or better yet import from a local file? Nothing here seems to suggest that packages must be loaded from an external URL.
- bgdam 6y ago> or better yet import from a local file And this is different from NPM how? Except that I've now lost all the tooling around NPM/Yarn.
- ryanseys 6y agoIt's different because it doesn't rely on require() which is non-standard JavaScript.
- bgdam 6y agoNode v14 supports ESM modules and the import syntax, which is standard Javascript.
- akamaozu 6y agosetTimeout is non-standard JavaScript too but I bet your code base has multiple instances of its usage.
- ric2b 6y agoIs it? It's on every browser I know.
- akamaozu 6y agoSee: https://stackoverflow.com/questions/8852198/settimeout-if-not-defined-in-ecmascript-spec-where-can-i-learn-how-it-works https://stackoverflow.com/questions/8852198/settimeout-if-no...
- ric2b 6y agoAh, makes sense, it's not part of the spec so it might be missing on other environments. Thank you.
- mekkkkkk 6y agoIt's different because it is much further removed from a centrally controlled dumpster fire. The JS, Node and NPM ecosystem is a pain on so many levels. Blindly trusting developers to follow semver by default. Leftpad. Build toolchains. The whole micro-depedency madness. Having a peek into your node_modules is like looking into the depths of hell. Not saying Deno won't devolve into this sad state at some point. Maybe it already has. But it seems to try to combat some of the problems by being honest and pragmatic about dependencies, promoting minimal external tooling and removing some of the dangerous abstractions from NPM. To me Deno seems like a desperately needed and well thought out reset button. Semi-related rant over.
- batmansmk 6y agoHi! The response to your fears are in the announcement. "If you want to download dependencies alongside project code instead of using a global cache, use the $DENO_DIR env variable." Then, it will work like node_modules.
- fermienrico 6y agoI think the primary way to manage dependencies should be in a local DIR and optionally, a URL can be specified. The default in Deno is questionable choice. Just don't fuck with what works. Default should be safest followed by developers optionally enabling less safe behaviors.
- fiddlerwoaroof 6y agoUsing a universally unique identifier like a URL is a good idea: this way, https://foo.com/foo https://foo.com/foo and https://bar.com/foo https://bar.com/foo are distinct and anyone who can register their own name gets a namespace, without relying on yet another centralized map of names->resources. After all, the whole point of a URL is that it unambiguously identifies resources in a system-independent way.
- littlestymaar 6y agoGood luck finding which of foo.com/foo or bar.com/foo is the foo module you want though…
- janpot 6y agoGood luck finding which of google.com/search or bing.com/search is the search engine you want though
- littlestymaar 6y agoThis is true actually, and that's why being the default search engine is so important Google pays billions each year for that.
- merpnderp 6y agoYou’d deploy builds that include all the dependencies. This isn’t Node where you have to download all deps on your production server, they are built into your deployed files.
- bananabreakfast 6y agoEver used Go? Not that different.
- deleted 6y ago[deleted]
- PudgePacket 6y agoThen you either vendor as others have said, or use the built in bundle tool to produce a single js file of all your code including dependencies. https://deno.land/manual/tools/bundler https://deno.land/manual/tools/bundler
- CGamesPlay 6y agoSeveral responses to your concern but all of them seem to say "you can cache dependencies". How does Deno find dependencies ahead of runtime? Does Deno not offer dynamic imports at all? If I have an application that uses, say, moment.js and want to import a specific locale, typically this is done using a dynamic import.
- Aeolun 6y agoHow is this different from requiring npm to be up to install packages?
- 29athrowaway 6y agoReproducible builds, sure. Security? that's a different story. https://github.com/ChALkeR/notes/blob/master/Gathering-weak-npm-credentials.md https://github.com/ChALkeR/notes/blob/master/Gathering-weak-... - node ships with npm - npm has a high number of dependencies - npm does not implement good practices around authentication. Can someone compromise npm itself? probably, according to that article.
- fsloth 6y agoWhy can't you download all the packages you use actually with your source code? That's how software has been built for decades... I'm a desktop developer so I understand I'm the dinosaur in the room but I've never understood why you would not cache all the component packages next to your own source code. Since this is straighforward to do I presume there is some tradeoff I've not thought about. Is it security? Do you want to get the latest packages automatically? But isn't that a security risk as well, as not all changes are improvements?
- IshKebab 6y agoThat is exactly what NPM does.
- emerongi 6y agoYou can commit your node_modules folder into your repository if you'd like.
- Cthulhu_ 6y agoFor Node, the main tradeoff is number and size of files. Usually the distribution of a node module (that which is downloaded into node_modules) contains the source, documentation, distribution, tests, etc. In my current project, it adds up to 500MB already. They would do well to have an option to optimize dependencies for vendoring.
- progx 6y agoSo build your own npm?
- softawre 6y agoYou're right. We call this "vendoring" your dependencies. And it's a good way to do things.