4 ms·
> these are used when you're making your own builds anyway That's the problem: they encourage building with tons of random stuff pulled from the Internet on th
by eeZah7Ux 6y ago
> these are used when you're making your own builds anyway
That's the problem: they encourage building with tons of random stuff pulled from the Internet on the fly, sidestepping OS distributions completely and providing no reproducible building, no vetting, no license review, no long-term security.
The leftpad disaster is a good example.
- einpoklum 6y agoCan you link to a description of "the leftpad disaster"? Also - it's not supposed to be "tons of random stuff", it's supposed to be the libraries you're relying on. Maybe I'm missing something in the point you're making?
- eeZah7Ux 6y agoRandom link: https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how-to-program/ https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how... > it's supposed to be the libraries you're relying on When an ecosystem has poor engineering practices and encourages small libraries with many dependencies you get a quadratic explosion of indirect dependencies. You might not care about having 100 transitive dependencies until a poor soul has to maintain your code in 4 or 10 years from now.