3 ms·

it takes time to get adoption and all browsers have to implement it. Also https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Stri

by qudat 5y ago

it takes time to get adoption and all browsers have to implement it. Also https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/padStart https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

simion314 5y ago
>it takes time to get adoption and all browsers have to implement it. You can make it a library , name it STL-extras. So instead of having 10 packages with 10 copy of left pad, 12 packages with some copies of isOdd and other ridiculosness you have this 1 STL-extra library that is reviewed by Google and Mozilla.
- cxr 5y ago
  How does this make for a solution that meaningfully differs from just declaring that any problem can be taken care of by someone else doing all the work? In this case, the work is certainly doable; that's not the problem. "We'll make sure all the code we ship or consume is audited" works as a strategy against the problem that exists here. "We'll make sure it's audited, but we're not going to pay for any of it" would also "work" so long as you're able to achieve that, but achieving it is what presents difficulties. How does your proposal take those difficulties into account? It sounds a lot like when you tell a child that you don't have enough money for something and they tell you to go get money at the bank.
  - simion314 5y ago
    My solution does not fix the problem, it reduces it, so if we get all the missing STL functions in a trusted STL package then you as a web developer will have to review 200 less packages. But maybe some other luicky guys will have to review no package at all since most of what they need is in this STL-extra. You can come with other solutions to reduce the problem further, like some of the other ideas suggested, one of the ideas is to maybe make it less CV worthy to have a npm package to discourage the behavior we seen where someone creates or forks some package and then pushes it into other projects just for fame. I apologize if I miss-understood your point, honestly is not clear what you did not like about an optional STL library that is trusted and people could use instead of 100 untrusted leftpad like ones.

by qudat 5y ago

simion314 5y ago

>it takes time to get adoption and all browsers have to implement it. You can make it a library , name it STL-extras. So instead of having 10 packages with 10 copy of left pad, 12 packages with some copies of isOdd and other ridiculosness you have this 1 STL-extra library that is reviewed by Google and Mozilla.

cxr 5y ago
How does this make for a solution that meaningfully differs from just declaring that any problem can be taken care of by someone else doing all the work? In this case, the work is certainly doable; that's not the problem. "We'll make sure all the code we ship or consume is audited" works as a strategy against the problem that exists here. "We'll make sure it's audited, but we're not going to pay for any of it" would also "work" so long as you're able to achieve that, but achieving it is what presents difficulties. How does your proposal take those difficulties into account? It sounds a lot like when you tell a child that you don't have enough money for something and they tell you to go get money at the bank.
- simion314 5y ago
  My solution does not fix the problem, it reduces it, so if we get all the missing STL functions in a trusted STL package then you as a web developer will have to review 200 less packages. But maybe some other luicky guys will have to review no package at all since most of what they need is in this STL-extra. You can come with other solutions to reduce the problem further, like some of the other ideas suggested, one of the ideas is to maybe make it less CV worthy to have a npm package to discourage the behavior we seen where someone creates or forks some package and then pushes it into other projects just for fame. I apologize if I miss-understood your point, honestly is not clear what you did not like about an optional STL library that is trusted and people could use instead of 100 untrusted leftpad like ones.