3 ms·

So npm gives you warnings about vulnerabilities and that's a bad thing? You notice you have thousands of outdated dependencies and that's a bad thing? I used

by midrus 5y ago

So npm gives you warnings about vulnerabilities and that's a bad thing? You notice you have thousands of outdated dependencies and that's a bad thing? I used to work a lot with python years ago, and the only reasons we didn't have this problems was because the packages management was so terrible that you didn't even notice you had to update dependencies or that they had vulnerabilities.

Draiken 5y ago
Most languages I've used don't *need* to have 1000 dependencies like JS does. They also don't have thousands of projects depending on ridiculous packages like left pad because they actually have a standard library. The surface of vulnerabilities and the brittleness of the entire ecosystem is the bad thing, not the warnings.
lanstin 5y ago
Diff being you usually have like five python deeps for every hundred npm deps a d you can do the old school thing and subscribe to the security alerts for those deps. The difference in number of deps means you have the cognitive space to understand them. Npm needed to automate because the numbers are too high. One of python’s old selling points was “Batteries included”. And the idea is fewer large library rather than a bunch of tiny libraries. With a small number of deps where you skim the development DL, you know if there is a security issue or a cool new feature you want. Also it has more of the Unix C philosophy of don’t break stable APIs in new releases. So upgrading mostly just worked. (Stuff like deliberately breaking old SSL protocols aside). (Until python 3 of course.)
- jonnycomputer 5y ago
  I got to pains to limit how many python external libraries I use, for all these reasons. But because Python is so capable on its own, it works.
heavyset_go 5y ago
> So npm gives you warnings about vulnerabilities and that's a bad thing? > You notice you have thousands of outdated dependencies and that's a bad thing? This is a weird reply considering that the OP literally said those were a good thing: > Oh, `npm install`? You just found out you got like 1000+ vulnerabilities. Alright, good thing it told me actually, let me update. The bad things are in the lines that follow.
wreath 5y ago
Not OP but what I think they struggled with is fixing warnings. JS projects are like a poorly built house, things are constantly deteriorating and need constant maintenance.
- iso1210 5y ago
  I've got a new nodejs project that a colleague wrote about 6 months ago. It's already completely broken and needed a lot of effort to get working again. On the other hand his php project from 2011 still works, just as my perl stuff from 2006 still just works.
  - wreath 5y ago
    This doesn't sound foreign to me. Node projects rely on a lot of dependencies (and so does their dependencies) so there is a lot of moving parts and it's prone to break.
neya 5y ago
> So npm gives you warnings about vulnerabilities and that's a bad thing? > Alright, good thing it told me actually, let me update.

by midrus 5y ago

Draiken 5y ago

Most languages I've used don't *need* to have 1000 dependencies like JS does. They also don't have thousands of projects depending on ridiculous packages like left pad because they actually have a standard library. The surface of vulnerabilities and the brittleness of the entire ecosystem is the bad thing, not the warnings.

lanstin 5y ago

Diff being you usually have like five python deeps for every hundred npm deps a d you can do the old school thing and subscribe to the security alerts for those deps. The difference in number of deps means you have the cognitive space to understand them. Npm needed to automate because the numbers are too high. One of python’s old selling points was “Batteries included”. And the idea is fewer large library rather than a bunch of tiny libraries. With a small number of deps where you skim the development DL, you know if there is a security issue or a cool new feature you want. Also it has more of the Unix C philosophy of don’t break stable APIs in new releases. So upgrading mostly just worked. (Stuff like deliberately breaking old SSL protocols aside). (Until python 3 of course.)

jonnycomputer 5y ago
I got to pains to limit how many python external libraries I use, for all these reasons. But because Python is so capable on its own, it works.

heavyset_go 5y ago

> So npm gives you warnings about vulnerabilities and that's a bad thing? > You notice you have thousands of outdated dependencies and that's a bad thing? This is a weird reply considering that the OP literally said those were a good thing: > Oh, `npm install`? You just found out you got like 1000+ vulnerabilities. Alright, good thing it told me actually, let me update. The bad things are in the lines that follow.

wreath 5y ago

Not OP but what I think they struggled with is fixing warnings. JS projects are like a poorly built house, things are constantly deteriorating and need constant maintenance.

iso1210 5y ago
I've got a new nodejs project that a colleague wrote about 6 months ago. It's already completely broken and needed a lot of effort to get working again. On the other hand his php project from 2011 still works, just as my perl stuff from 2006 still just works.
- wreath 5y ago
  This doesn't sound foreign to me. Node projects rely on a lot of dependencies (and so does their dependencies) so there is a lot of moving parts and it's prone to break.

neya 5y ago

> So npm gives you warnings about vulnerabilities and that's a bad thing? > Alright, good thing it told me actually, let me update.