3 ms·

I have been ruminating on this very thought for some time... "I started out mocking NPM for the left-pad debacle, but over time I've actually grown more sympath

I have been ruminating on this very thought for some time... "I started out mocking NPM for the left-pad debacle, but over time I've actually grown more sympathetic to left-pad. The problem isn't that somebody wrote a library for left-pad. It is that even something as trivial as left-pad has triggered our division-of-labor instincts. A library like left-pad is just begging to be saved into projects that use it so users have one less moving part to worry about at deployment time. Turning it into a first-class dependency also ensured that a lot less people looked inside it to understand its five lines of code or whatever." I think we should be extracting code from libraries until we need the whole thing. Dragging around black box dependencies as binaries has a lot of serious drawbacks. If people had extracted the parts they needed from log4j they wouldn't have even had to think about the exploits.

Jtsummers 5y ago
Pulling out just the subcomponents you need is actually easier with a more modular design. But akkartik also opposes modularity, or at least has expressed a less-than-positive disposition towards it: > I think namespaces and modules are socially counter-productive even when implemented in a technically impeccable manner, because they encourage division of labor. Namespaces and modules are precisely what you need to be able to select parts of a larger system and ignore other parts. Without them, you're faced with numerous "monoliths", excessively large systems that don't decompose into reusable, isolatable bits. That forces you to import too much, or to recreate just the part that you care about (often a waste of time).
- ReactiveJelly 5y ago
  I was very surprised by that line, too. I make namespaces and modules in my own projects just so that I can use simple names like "update" or "load" un-ambiguously. Projects that nobody else has ever touched and maybe nobody ever will. It's been a popular C++ style since before I did C++, and now it's also idiomatic Rust style. Is OP really advocating for a C style where everything must be fully-qualified? It's horrifying to read GTK+ C code because of that. Everything is `gtk_do_a_thing` and all code operates on a `GtkTypeOfGtkObject`. One of these days I'll get RSI, I only have so many keystrokes left in me! Have mercy! And you can't rename things, so good luck mixing incompatible major versions of Qt or GTK+ in a C or C++ project. (Actually, Qt has a compile-time flag to put it in a namespace. Maybe GTK+ has some similar ugly macro. But this requires you to compile your own dependencies, a task which is especially annoying, inconvenient, and error-prone in the C family)
ReactiveJelly 5y ago
I don't even think micro-packages are that bad. The problems with NPM seem to have been that the "Always upgrade immediately! Upgrades are good for security and have no downsides!" people are winning the PR fight against us "Upgrade cautiously and never allow autonomous upgrades. Upgrades are important for security but they have many caveats" people. One is a more Windows attitude of "I know you've never gotten a virus, but if you don't upgrade, you _will_ get a virus and you _will_ die" whereas my attitude is more of a Linux "The only time my Linux system breaks is when I upgrade it."

Jtsummers 5y ago

Pulling out just the subcomponents you need is actually easier with a more modular design. But akkartik also opposes modularity, or at least has expressed a less-than-positive disposition towards it: > I think namespaces and modules are socially counter-productive even when implemented in a technically impeccable manner, because they encourage division of labor. Namespaces and modules are precisely what you need to be able to select parts of a larger system and ignore other parts. Without them, you're faced with numerous "monoliths", excessively large systems that don't decompose into reusable, isolatable bits. That forces you to import too much, or to recreate just the part that you care about (often a waste of time).

ReactiveJelly 5y ago
I was very surprised by that line, too. I make namespaces and modules in my own projects just so that I can use simple names like "update" or "load" un-ambiguously. Projects that nobody else has ever touched and maybe nobody ever will. It's been a popular C++ style since before I did C++, and now it's also idiomatic Rust style. Is OP really advocating for a C style where everything must be fully-qualified? It's horrifying to read GTK+ C code because of that. Everything is `gtk_do_a_thing` and all code operates on a `GtkTypeOfGtkObject`. One of these days I'll get RSI, I only have so many keystrokes left in me! Have mercy! And you can't rename things, so good luck mixing incompatible major versions of Qt or GTK+ in a C or C++ project. (Actually, Qt has a compile-time flag to put it in a namespace. Maybe GTK+ has some similar ugly macro. But this requires you to compile your own dependencies, a task which is especially annoying, inconvenient, and error-prone in the C family)

ReactiveJelly 5y ago

I don't even think micro-packages are that bad. The problems with NPM seem to have been that the "Always upgrade immediately! Upgrades are good for security and have no downsides!" people are winning the PR fight against us "Upgrade cautiously and never allow autonomous upgrades. Upgrades are important for security but they have many caveats" people. One is a more Windows attitude of "I know you've never gotten a virus, but if you don't upgrade, you _will_ get a virus and you _will_ die" whereas my attitude is more of a Linux "The only time my Linux system breaks is when I upgrade it."