3 ms·

Seeing how there are dozens of package management toolchains out there, why is NPM so uniquely absolutely horrible? The only behavioral difference I see is tha

Seeing how there are dozens of package management toolchains out there, why is NPM so uniquely absolutely horrible? The only behavioral difference I see is that with most other package tools, installing a dependency pins the specific version of the dependency you installed. So why does NPM instead pin "any version at least this, or greater"? Feels like a decision that was made when the tooling was young to help improve reliability that has since created this nightmare. Is Yarn better about it?

gedy 5y ago
> So why does NPM instead pin "any version at least this, or greater"? It doesn't, it follows semver and you can pin to point, minor, major, etc versions depending on your package.json
hinkley 5y ago
There is a flag you can override to be less aggressive, and it's in our onboarding docs, but only because I added it after a conversation with the only other individual on our team who was using it. It's the classical situation of the framework having defaults that end up being actively hostile to developer success. These Primrose Path situations get under my skin like few things do.
- etchalon 5y ago
  Wasn't aware of the flag. Thanks!
CraigJPerry 5y ago
>> why is NPM so uniquely absolutely horrible? I don’t think it’s uniquely bad. For example, Python’s story is just as bad. The Java world is the best i know of but even relatively modern stacks like Rust are still making the same errors long-solved in the java world. For example, nothing stops me publishing a google-grpc crate today (first come first served on names and that name’s not taken and i don’t need to prove ownership of my domain like in the java world). C# and nuget is a blind spot for me so I don’t know. Go gets it right arguably even better than Java. Deno borrows the same decentralised idea. The whole situation is a stack of cards right now though. I’m genuinely surprised we haven’t seen more specific targeting of high value maintainers. Github is arguably ahead of the curve here a little bit (e.g. the ability to flag and act on unsigned commits).
- etchalon 5y ago
  I've been working with Python for 15 years and I don't remember any period of constant attacks as I see with NPM. Did I just miss them?
  - CraigJPerry 5y ago
    I guess so - there’s certainly been enough examples of various attacks, from typo squatting and dependency confusion right through to crypto mining and exfiltration of user’s data from their machine.
neurotrace 5y ago
> why is NPM so uniquely absolutely horrible? I'm not sure that it is. I think it's a numbers game. I've read* that npm is the largest repository in the world. More actors means more good and bad actors. * Taken from this link. Old article and I'm not sure what the original data source is: https://www.linux.com/news/state-union-npm/ https://www.linux.com/news/state-union-npm/
feross 5y ago
JavaScript is so much larger than every other ecosystem, so even a very small probability event (somebody introducing malware into a package) can happen surprisingly often given the scale of the ecosystem. Supply chain attacks are a problem in all open source ecosystems – not just JS – but they are a bit rarer and don't effect as many people so fewer people take note.

gedy 5y ago

> So why does NPM instead pin "any version at least this, or greater"? It doesn't, it follows semver and you can pin to point, minor, major, etc versions depending on your package.json

hinkley 5y ago

There is a flag you can override to be less aggressive, and it's in our onboarding docs, but only because I added it after a conversation with the only other individual on our team who was using it. It's the classical situation of the framework having defaults that end up being actively hostile to developer success. These Primrose Path situations get under my skin like few things do.

etchalon 5y ago
Wasn't aware of the flag. Thanks!

CraigJPerry 5y ago

>> why is NPM so uniquely absolutely horrible? I don’t think it’s uniquely bad. For example, Python’s story is just as bad. The Java world is the best i know of but even relatively modern stacks like Rust are still making the same errors long-solved in the java world. For example, nothing stops me publishing a google-grpc crate today (first come first served on names and that name’s not taken and i don’t need to prove ownership of my domain like in the java world). C# and nuget is a blind spot for me so I don’t know. Go gets it right arguably even better than Java. Deno borrows the same decentralised idea. The whole situation is a stack of cards right now though. I’m genuinely surprised we haven’t seen more specific targeting of high value maintainers. Github is arguably ahead of the curve here a little bit (e.g. the ability to flag and act on unsigned commits).

etchalon 5y ago
I've been working with Python for 15 years and I don't remember any period of constant attacks as I see with NPM. Did I just miss them?
- CraigJPerry 5y ago
  I guess so - there’s certainly been enough examples of various attacks, from typo squatting and dependency confusion right through to crypto mining and exfiltration of user’s data from their machine.

neurotrace 5y ago

> why is NPM so uniquely absolutely horrible? I'm not sure that it is. I think it's a numbers game. I've read* that npm is the largest repository in the world. More actors means more good and bad actors. * Taken from this link. Old article and I'm not sure what the original data source is: https://www.linux.com/news/state-union-npm/ https://www.linux.com/news/state-union-npm/

feross 5y ago

JavaScript is so much larger than every other ecosystem, so even a very small probability event (somebody introducing malware into a package) can happen surprisingly often given the scale of the ecosystem. Supply chain attacks are a problem in all open source ecosystems – not just JS – but they are a bit rarer and don't effect as many people so fewer people take note.