2 ms·

Serious question from someone not in the web development field: What's keeping developers from just downloading the js libraries they depend on and hosting them

• dagw 5y ago
  Technically nothing. Practically, it's not the default behavior and none of the Getting Started documentation you'll read will teach you how to do it. So almost nobody does.
• huseyinkeles 5y ago
  Nothing keeps you, but it's not easy to keep them up to date manually + those libraries have their own dependencies.
• Cthulhu_ 5y ago
  It's not uncommon for companies to host a proxy that theoretically can guard against depublishing; probably a good practice as well since it offloads the npm repo. But, someone has to set that up and take ownership of it, which is a problem in most companies (it's often some guy that sets it up and it runs fine for years afterwards, until it doesn't)
• globular-toast 5y ago
  Nothing. There are even off the shelf solutions available (like Artifactory). But it's not part of standard tooling and many web developers don't really know what they're doing when it comes to this stuff. I do a lot of interviewing and I'm amazed by how many developers not only don't seem to care much about dependencies but don't even understand that it's a problem at all. In another industry this would be used an example failure for training new engineers. But people seem to have an aversion to formal training and prefer on-the-job training. But that means you can easily end up with an engineer who simply "got lucky" for 5 years by not following any kind of good practice. Do you really want him to learn these lessons with your data/time/money?