5 ms·

It seems some of the new package systems such as node/npm fail to learn from years of maturity of existing ecosystem such as Java's

raverbashing 6y ago
"Years of maturity" or, just thinking about the problem for a bit. How long did it take npm to have scoped packages. Sure, let me create a "paypal" project, they only need one js project no? If Java suffers from excessive bureaucracy, the newer package developers/repos suffer from too much eagerness to ship something without thinking Not to mention dependency and version craziness. If you want your software to be repeatable you need to be specific with the versions and code you're taking.
- mstipetic 6y ago
  It drives me crazy that "official" sounding package names like yaml are seemingly given basically first-come first serve, with no oversight. Publish anything you want, but call it Mark's awesome yaml library, or companyName-yaml or something like that so that people are aware that's not an officially supported project
  - jrochkind1 6y ago
    What would you imagine that oversight looking like, who decides who gets the name `yaml`, and how do they verify it, and who pays for that time?
    - throw_m239339 6y ago
      > What would you imagine that oversight looking like, who decides who gets the name `yaml`, and how do they verify it, and who pays for that time? Just use name spaces. foo.com/yaml instead of yaml. NPM way of doing things is/was just insane, with no regard for trust or security. No wonder NPM corp then went into the business of selling namespaces, AKA selling trust...
    - mstipetic 6y ago
      Unless it's a part of the standard library included with the language, nobody gets it. There has to be some designation before the name. It's not only node, python also does things like that
      - jrochkind1 6y ago
        I don't understand how a designation in front of the name solves anything. The designation is basically just a name itself, you've just made it a two-part name, and a requirement that all names have two parts. ok, so?
        saagarjha 6y ago
        The first part is going to be your name.
deleted 6y ago
[deleted]
ratherbefuddled 6y ago
As someone who worked with java for more than a decade before touching the js world, the degree to which npm has been hacked together without any of study prior art is extremely irritating. If you must build something from scratch at least invent some new problems instead of just re-discovering solved ones. The very existence of package-lock grinds my gears and that's before it starts flip flopping because someone mistook URLs for URIs. Of course that only exists because ranged dependencies are a terrible idea, and that's before anybody even mentions things like namespaces or classifiers. No maven wasn't perfection, and it could be (and has been) improved on - but npm doesn't even get into spitting distance.

raverbashing 6y ago

"Years of maturity" or, just thinking about the problem for a bit. How long did it take npm to have scoped packages. Sure, let me create a "paypal" project, they only need one js project no? If Java suffers from excessive bureaucracy, the newer package developers/repos suffer from too much eagerness to ship something without thinking Not to mention dependency and version craziness. If you want your software to be repeatable you need to be specific with the versions and code you're taking.

mstipetic 6y ago
It drives me crazy that "official" sounding package names like yaml are seemingly given basically first-come first serve, with no oversight. Publish anything you want, but call it Mark's awesome yaml library, or companyName-yaml or something like that so that people are aware that's not an officially supported project
- jrochkind1 6y ago
  What would you imagine that oversight looking like, who decides who gets the name `yaml`, and how do they verify it, and who pays for that time?
  - throw_m239339 6y ago
    > What would you imagine that oversight looking like, who decides who gets the name `yaml`, and how do they verify it, and who pays for that time? Just use name spaces. foo.com/yaml instead of yaml. NPM way of doing things is/was just insane, with no regard for trust or security. No wonder NPM corp then went into the business of selling namespaces, AKA selling trust...
  - mstipetic 6y ago
    Unless it's a part of the standard library included with the language, nobody gets it. There has to be some designation before the name. It's not only node, python also does things like that
    - jrochkind1 6y ago
      I don't understand how a designation in front of the name solves anything. The designation is basically just a name itself, you've just made it a two-part name, and a requirement that all names have two parts. ok, so?
      - saagarjha 6y ago
        The first part is going to be your name.

deleted 6y ago

[deleted]

ratherbefuddled 6y ago

As someone who worked with java for more than a decade before touching the js world, the degree to which npm has been hacked together without any of study prior art is extremely irritating. If you must build something from scratch at least invent some new problems instead of just re-discovering solved ones. The very existence of package-lock grinds my gears and that's before it starts flip flopping because someone mistook URLs for URIs. Of course that only exists because ranged dependencies are a terrible idea, and that's before anybody even mentions things like namespaces or classifiers. No maven wasn't perfection, and it could be (and has been) improved on - but npm doesn't even get into spitting distance.