3 ms·

Small packages like this are key to easily/quickly building polyfill, backport, backcompat bundles for deployment in environments that are quite a bit behind in

Small packages like this are key to easily/quickly building polyfill, backport, backcompat bundles for deployment in environments that are quite a bit behind in terms of language support. They still exist and they are still making people money. Having a stdlib in JavaScript would not preclude packages like this due to the afore mentioned legacy environments. NPM bashing is increasingly popular, and for folks that haven't had to utilize these tiny packages they probably do rightly seem superfluous. Are people abusing it? Probably. Is it being used where it doesn't need to be? Probably. Are there long-stable, rarely changed NPM packages created before `Array.isArray` was a thing, which have this as a transitive dependency? Definitely.

Benjammer 6y ago
This argument makes a ton of sense to me. Why is this not how most people explain it, rather than "all developers are stupid and they mess up one-liners so we should write their software for them"? How it normally goes: A: why does this exist it's one line? B: people mess up one-liners all the time. A: those people are dumb and shouldn't be programmers How it should go: A: why does this exist, it's one line? B: it's not about that, it's used to easily/quickly compose with other similar functions into more complicated things like polyfill, backport, and backcompat bundles for deployment in environments that are quite a bit behind in terms of language support. A: oh, neat, thanks!
marcus_holmes 6y ago
It's literally 5 lines of code. My question is always "why is this a dependency and not a Stack Overflow answer?" For anyone who imported this as a dependency, why didn't you copy-paste the five lines into your code? I'm genuinely curious.
- brightball 6y ago
  This is always my question as well.
- slooonz 6y ago
  Do you also copy-paste the 36 lines of unit tests in your project ?
  - marcus_holmes 6y ago
    No, I'd maybe run them once just to check it covers the corner-cases. The code is never going to change, because it's a polyfill for old browsers, and only needed for legacy environments that won't change. So if the tests pass once, they'll pass forever. There is literally no point in adding those tests to my test suite - there is no combination of changes that will ever make this fail if it passes once.
- marketingPro 6y ago
  I've wondered this too. I've seen someone make a COVID data library but I thought about how much more difficult it would be to learn the library instead of just importing and manipulating the data. My best thought is that it saves time to import, it saves visual lines which may make it easier to understand what is code ripe for modification and code that shouldn't be changed.
- deleted 6y ago
  [deleted]
- ryandrake 6y ago
  My response to that is, "Is your company really OK with copy-pasting from Stack Overflow into their production system?" Do you know what license the Stack Overflow content is released under [1]? Is that license compatible with your company's software? Are you complying with the terms of that license, including providing any required attribution? Who gets sued or fired if that copy-pasted code doesn't work? What goes into the post-mortem? Similarly, is your company really OK with you just pulling in a dependency and coding onward? Do you review each external dependency's license for compatibility with your company's software? Do you audit each dependency for security issues, backdoors, and other bugs? What dependencies do your dependencies rely on, and have you reviewed them, too? How do you know the dependency works as you think it should work? What is the maintenance plan for this dependency? How often do you plan to update the dependency, and when you do, do you plan to re-audit it? As someone who has worked on safety-critical marine and aerospace applications, this casual attitude about pulling in dependencies and copy-pasting code is so foreign to me! Is this yolo attitude really how it works in the move-fast-and-break-things universe? No large company I ever worked for would allow any of this without proper vetting and reviewing--even on non-safety-critical programs. Really interesting and scary how best practices are defined in various areas of the software development world! 1: https://stackoverflow.com/help/licensing https://stackoverflow.com/help/licensing
  - marcus_holmes 6y ago
    It's 5 lines of code. Yes I'm fine with copy-pasting that into a production system. Yes I just reviewed it, by reading the 5 lines of code and deciding that they were OK to deploy to a production system. I totally get your point, though, and completely agree with you on more complex examples. I would not feel comfortable copy-pasting code into my system that I didn't understand or hadn't read through completely. And I avoid dependencies as much as possible.
Scarbutt 6y ago
bundles for deployment in environments that are quite a bit behind in terms of language support. Isn't this what babel is for?
- andrew_ 6y ago
  It's a possible solution, depending on need and context. but it isn't a fix-all.
tzs 6y ago
JavaScript has had isArray a long time--even IE 9 has it. I'm surprised that there is enough active development going on for browsers that don't have it to lead to 40 M downloads a week. I'd have expected most things that have to support browsers that old would be mature projects that do not get much active development.

Benjammer 6y ago

This argument makes a ton of sense to me. Why is this not how most people explain it, rather than "all developers are stupid and they mess up one-liners so we should write their software for them"? How it normally goes: A: why does this exist it's one line? B: people mess up one-liners all the time. A: those people are dumb and shouldn't be programmers How it should go: A: why does this exist, it's one line? B: it's not about that, it's used to easily/quickly compose with other similar functions into more complicated things like polyfill, backport, and backcompat bundles for deployment in environments that are quite a bit behind in terms of language support. A: oh, neat, thanks!

marcus_holmes 6y ago

It's literally 5 lines of code. My question is always "why is this a dependency and not a Stack Overflow answer?" For anyone who imported this as a dependency, why didn't you copy-paste the five lines into your code? I'm genuinely curious.

brightball 6y ago
This is always my question as well.
slooonz 6y ago
Do you also copy-paste the 36 lines of unit tests in your project ?
- marcus_holmes 6y ago
  No, I'd maybe run them once just to check it covers the corner-cases. The code is never going to change, because it's a polyfill for old browsers, and only needed for legacy environments that won't change. So if the tests pass once, they'll pass forever. There is literally no point in adding those tests to my test suite - there is no combination of changes that will ever make this fail if it passes once.
marketingPro 6y ago
I've wondered this too. I've seen someone make a COVID data library but I thought about how much more difficult it would be to learn the library instead of just importing and manipulating the data. My best thought is that it saves time to import, it saves visual lines which may make it easier to understand what is code ripe for modification and code that shouldn't be changed.
deleted 6y ago
[deleted]
ryandrake 6y ago
My response to that is, "Is your company really OK with copy-pasting from Stack Overflow into their production system?" Do you know what license the Stack Overflow content is released under [1]? Is that license compatible with your company's software? Are you complying with the terms of that license, including providing any required attribution? Who gets sued or fired if that copy-pasted code doesn't work? What goes into the post-mortem? Similarly, is your company really OK with you just pulling in a dependency and coding onward? Do you review each external dependency's license for compatibility with your company's software? Do you audit each dependency for security issues, backdoors, and other bugs? What dependencies do your dependencies rely on, and have you reviewed them, too? How do you know the dependency works as you think it should work? What is the maintenance plan for this dependency? How often do you plan to update the dependency, and when you do, do you plan to re-audit it? As someone who has worked on safety-critical marine and aerospace applications, this casual attitude about pulling in dependencies and copy-pasting code is so foreign to me! Is this yolo attitude really how it works in the move-fast-and-break-things universe? No large company I ever worked for would allow any of this without proper vetting and reviewing--even on non-safety-critical programs. Really interesting and scary how best practices are defined in various areas of the software development world! 1: https://stackoverflow.com/help/licensing https://stackoverflow.com/help/licensing
- marcus_holmes 6y ago
  It's 5 lines of code. Yes I'm fine with copy-pasting that into a production system. Yes I just reviewed it, by reading the 5 lines of code and deciding that they were OK to deploy to a production system. I totally get your point, though, and completely agree with you on more complex examples. I would not feel comfortable copy-pasting code into my system that I didn't understand or hadn't read through completely. And I avoid dependencies as much as possible.

Scarbutt 6y ago

bundles for deployment in environments that are quite a bit behind in terms of language support. Isn't this what babel is for?

andrew_ 6y ago
It's a possible solution, depending on need and context. but it isn't a fix-all.

tzs 6y ago

JavaScript has had isArray a long time--even IE 9 has it. I'm surprised that there is enough active development going on for browsers that don't have it to lead to 40 M downloads a week. I'd have expected most things that have to support browsers that old would be mature projects that do not get much active development.