4 ms·

> Ubuntu has 10s of thousands of packages. NPM has well over a million. The average update frequency is also much higher, as is the number of contributors per-p

> Ubuntu has 10s of thousands of packages. NPM has well over a million. The average update frequency is also much higher, as is the number of contributors per-package. Node's culture of tiny libraries (partly caused by Javascript's tiny standard lib) is a big part of the problem and increases the number of potential supply chain issues.

danShumway 5y ago
It's not that Ubuntu has fewer packages because it's 30x more efficient with how it packages software -- it has fewer libraries because it has less software and less developer attention. It's not at all uncommon for me in Debian systems to have to search out non-distro repositories to pull from. And that's even before we get into the issue that Ubuntu/Debian repositories aren't rolling release. I often find myself jumping outside of the official Ubuntu repos even for software that they provide, just because they're out of date; it's one of the biggest reasons why I eventually moved to Arch. Yes, JS dependency chains are out of control. No, that's not the only reason why there are over a million packages on NPM. No, the solution to the scalability problem of human-curated package managers can't be, "well, we just won't scale." Adding a bigger standard library to JS would not be enough to get rid of 970,000 npm packages.
lucideer 5y ago
Node's culture of tiny libraries is overstated. See https://news.ycombinator.com/item?id=30989539 https://news.ycombinator.com/item?id=30989539 What standard libs are you comparing? Node's to what other language? I've seen so many commenters say this, but still not sure what the magical thing that can't be achieved with Node built-ins is... Developers don't write libs because you can't do it with built-ins, the write libs because developers like to write code and NPM is easy to use.
- infamia 5y ago
  > Node's culture of tiny libraries is overstated. See https://news.ycombinator.com/item?id=30989539 https://news.ycombinator.com/item?id=30989539 You need thousands of packages for a pretty standard React application (which requires hundreds of base packages). That's a cultural problem in Node's packaging community that injects risk into the packaging ecosystem. > What standard libs are you comparing? Node's to what other language? I've seen so many commenters say this, but still not sure what the magical thing that can't be achieved with Node built-ins is... Brandon Eich himself has said that JS has a purposefully small standard library. https://www.infoworld.com/article/3048833/brendan-eich-javascript-standard-library-will-stay-small.html https://www.infoworld.com/article/3048833/brendan-eich-javas... JS' standard library is small compared with Python's for example. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... https://docs.python.org/3/library/ https://docs.python.org/3/library/

danShumway 5y ago

It's not that Ubuntu has fewer packages because it's 30x more efficient with how it packages software -- it has fewer libraries because it has less software and less developer attention. It's not at all uncommon for me in Debian systems to have to search out non-distro repositories to pull from. And that's even before we get into the issue that Ubuntu/Debian repositories aren't rolling release. I often find myself jumping outside of the official Ubuntu repos even for software that they provide, just because they're out of date; it's one of the biggest reasons why I eventually moved to Arch. Yes, JS dependency chains are out of control. No, that's not the only reason why there are over a million packages on NPM. No, the solution to the scalability problem of human-curated package managers can't be, "well, we just won't scale." Adding a bigger standard library to JS would not be enough to get rid of 970,000 npm packages.

lucideer 5y ago

Node's culture of tiny libraries is overstated. See https://news.ycombinator.com/item?id=30989539 https://news.ycombinator.com/item?id=30989539 What standard libs are you comparing? Node's to what other language? I've seen so many commenters say this, but still not sure what the magical thing that can't be achieved with Node built-ins is... Developers don't write libs because you can't do it with built-ins, the write libs because developers like to write code and NPM is easy to use.

infamia 5y ago
> Node's culture of tiny libraries is overstated. See https://news.ycombinator.com/item?id=30989539 https://news.ycombinator.com/item?id=30989539 You need thousands of packages for a pretty standard React application (which requires hundreds of base packages). That's a cultural problem in Node's packaging community that injects risk into the packaging ecosystem. > What standard libs are you comparing? Node's to what other language? I've seen so many commenters say this, but still not sure what the magical thing that can't be achieved with Node built-ins is... Brandon Eich himself has said that JS has a purposefully small standard library. https://www.infoworld.com/article/3048833/brendan-eich-javascript-standard-library-will-stay-small.html https://www.infoworld.com/article/3048833/brendan-eich-javas... JS' standard library is small compared with Python's for example. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... https://docs.python.org/3/library/ https://docs.python.org/3/library/