5 ms·

Having `import "github.com/liyue201/gostl/ds/array"` in codebase looks weird and unsafe. Like, who's liyue201 and what exactly I'm importing? Vendoring helps a

Having `import "github.com/liyue201/gostl/ds/array"` in codebase looks weird and unsafe. Like, who's liyue201 and what exactly I'm importing? Vendoring helps a bit, but it's still ugly. Same problems exist in other languages, although "import numpy as np" doesn't explicitly say that you're importing a random head from someone's master.

lokar 5y ago
You could setup your build to vendor. The import would be the same.
kortex 5y ago
> Same problems exist in other languages, although "import numpy as np" doesn't explicitly say that you're importing a random head from someone's master. Sure, python is just implicitly doing so, is that any better? Lets say you know nothing about python or numpy. You see "import numpy". What/who is numpy? How is it provisioned? Is there only one thing called numpy? How do you know it's installed locally/site-packages/editable/PYTHONPATH? You can answer these questions, but not immediately. Numpy is a poor example because it's so well know, but the other day I was trying to sort out "from pylab import *". Can't "pip install pylab". Turns out, matplotlib provides it, but for weird legacy reasons, pylab is a top level namespace. The whole point is, if you don't trust "liyue201", then you can immediately know not to import that package. It's completely explicit in what it's doing, and no one is making you install libs from github.
tikkabhuna 5y ago
Great thing about the import notation is it points you in the direction to look. Where’s the numpy code base? Your go.mod should specify the version of the library you’re using.
cuteboy19 5y ago
It's not much different from import com.mysql.cj.jdbc
- exdsq 5y ago
  I’ve never thought about that but yeah you’re right, that’s cool. I’m not a fan of Go’s imports either but this makes it make a little more sense to me.
mseepgood 5y ago
> explicitly say that you're importing a random head from someone's master You don't import HEAD from master. Do you even understand how go.mod, go.sum and the checksum database work?
jen20 5y ago
Frankly if it imparts that kind of concern, that is the dependency system working properly. ‘require “leftpad”’ may look safer, but is in fact not, and unless you happen to know what is in the standard library of Node.js off the top of your head, provides not so much as a clue that the library is even third party.
DelightOne 5y ago
What namespacing do you envision? On the one side you don't like short names that are installed locally and on the other you seem to not like the full url noting where to retrieve the library.
qbasic_forever 5y ago
On the contrary, I absolutely want to quickly and easily know if my corporate codebase is depending on github/<random user>. Golang has a pretty solid standard library and process to extend it. The 'x' packages are all reasonably vetted and close to official libraries: https://pkg.go.dev/golang.org/x https://pkg.go.dev/golang.org/x You could easily make a decree in a codebase that you won't depend on random github code and only use stuff from trusted sources like standard library, x, etc.

lokar 5y ago

You could setup your build to vendor. The import would be the same.

kortex 5y ago

> Same problems exist in other languages, although "import numpy as np" doesn't explicitly say that you're importing a random head from someone's master. Sure, python is just implicitly doing so, is that any better? Lets say you know nothing about python or numpy. You see "import numpy". What/who is numpy? How is it provisioned? Is there only one thing called numpy? How do you know it's installed locally/site-packages/editable/PYTHONPATH? You can answer these questions, but not immediately. Numpy is a poor example because it's so well know, but the other day I was trying to sort out "from pylab import *". Can't "pip install pylab". Turns out, matplotlib provides it, but for weird legacy reasons, pylab is a top level namespace. The whole point is, if you don't trust "liyue201", then you can immediately know not to import that package. It's completely explicit in what it's doing, and no one is making you install libs from github.

tikkabhuna 5y ago

Great thing about the import notation is it points you in the direction to look. Where’s the numpy code base? Your go.mod should specify the version of the library you’re using.

cuteboy19 5y ago

It's not much different from import com.mysql.cj.jdbc

exdsq 5y ago
I’ve never thought about that but yeah you’re right, that’s cool. I’m not a fan of Go’s imports either but this makes it make a little more sense to me.

mseepgood 5y ago

> explicitly say that you're importing a random head from someone's master You don't import HEAD from master. Do you even understand how go.mod, go.sum and the checksum database work?

jen20 5y ago

Frankly if it imparts that kind of concern, that is the dependency system working properly. ‘require “leftpad”’ may look safer, but is in fact not, and unless you happen to know what is in the standard library of Node.js off the top of your head, provides not so much as a clue that the library is even third party.

DelightOne 5y ago

What namespacing do you envision? On the one side you don't like short names that are installed locally and on the other you seem to not like the full url noting where to retrieve the library.

qbasic_forever 5y ago

On the contrary, I absolutely want to quickly and easily know if my corporate codebase is depending on github/<random user>. Golang has a pretty solid standard library and process to extend it. The 'x' packages are all reasonably vetted and close to official libraries: https://pkg.go.dev/golang.org/x https://pkg.go.dev/golang.org/x You could easily make a decree in a codebase that you won't depend on random github code and only use stuff from trusted sources like standard library, x, etc.