5 ms·
I like it because it's simpler. I know what happens when I import from a URL. I'd have a hard time whiteboarding exactly what happens when I `npm install`.
by mrkurt 6y ago
I like it because it's simpler. I know what happens when I import from a URL. I'd have a hard time whiteboarding exactly what happens when I `npm install`.
- searchableguy 6y agoWhat happens?
- sakarisson 6y agoMy least favorite thing about importing from NPM is that I don't actually know what I'm importing. Sure, there might be a GitHub repository, but code is uploaded to NPM separately, and it is often minified. A malicious library owner could relatively easily inject some code before minifying, while still maintaining a clean-looking repo alongside the package. Imports from URL would allow me to know exactly what I'm getting.
- searchableguy 6y agoinstall from the repo then? You can install a specific version from git via yarn/npm. How do you trust a url more without reading the code? What's going to stop deno ecosystem from putting minified js files on cdns and import them?