3 ms·
And this is why I hate the JS ecosystem. Everything is monkey patched by a bunch of randoms who published a package that scratched their itch and you have 0 ass
by moonchrome 5y ago
And this is why I hate the JS ecosystem. Everything is monkey patched by a bunch of randoms who published a package that scratched their itch and you have 0 assurances of their intent or stewardship. If you want to vet dependencies- good luck - the standard library is so shit that pulling one dependency might bring in a 100+ packages with it. Even the "big corporate sponsored" libraries depend on random crapware - like the leftpad incident clearly demonstrated.
Returning to .NET Core recently I'm very fond of the ecosystem in this regard - everything is open source - but so many things are provided by Microsoft you rarely have to venture out, even stuff that's not under their repo/umbrella has people paid by Microsoft working on it (eg. npgsql).
- lostmsu 5y agoWhy do you think .NET's NuGet is immune? Are you aware, that Microsoft bought NPM (or at least tried to)?
- moonchrome 5y agoBecause most nuget packages I get are from Microsoft, and if I use something that's not there is usually a Microsoft employee on the team or it's a trusted community package without random third party dependencies. Meanwhile half of npm was broken because of left pad. It's got nothing to do with npm as a repository - I don't trust the community.