4 ms·

I'm not sure how it's ignorant. I sort of prefer the C/C++ way of using/packaging libs. I wouldn't want it with higher level languages like C# or python, but a

I'm not sure how it's ignorant. I sort of prefer the C/C++ way of using/packaging libs. I wouldn't want it with higher level languages like C# or python, but a central repository isn't great in my opinion. Rust has people squatting on package names for no reason. Python packaging is so miserable there are a few different competing 3rd party package managers. NPM has had numerous security issues that have caused way more of a mess than anything C++ related. The C# package manager seems okay, but as far as I know will not package libraries as source code (I'm not sure about that one). All the package managers I've used have pros and cons, including using none at all.

MrBuddyCasino 4y ago
Shitty package managers are shitty, yet Maven just works. It seems Golang has figured out a workable approach after 10 years as well. Its a solved problem. If other package managers refuse to learn, thats on them.
eptcyka 4y ago
Why tie your application to a distribution? You're at the mercy of package maintainers, or you'll end up using docker to do package management in a safe way. There's 0 ways to ensure that installing your required dependencies yesterday and tomorrow on a fresh install of Debian won't differ in a critical way? You could do that with NixOS, but I doubt that's the OS/package manager of choice for the target audience of Hare. Relying on OS package managers is partly why docker became popular, far more than most of the designed features of docker and the respective kernel features. The fundamental issue with security of NPM is the same issue you encounter in any package manager, you have to trust the maintainers. It's harder to trust a larger group of people than a smaller group of people. I'd argue the better solution with NPM is to choose libraries more deliberately and monitor your dependency graph instead of stopping to use NPM altogether.

MrBuddyCasino 4y ago

Shitty package managers are shitty, yet Maven just works. It seems Golang has figured out a workable approach after 10 years as well. Its a solved problem. If other package managers refuse to learn, thats on them.

eptcyka 4y ago

Why tie your application to a distribution? You're at the mercy of package maintainers, or you'll end up using docker to do package management in a safe way. There's 0 ways to ensure that installing your required dependencies yesterday and tomorrow on a fresh install of Debian won't differ in a critical way? You could do that with NixOS, but I doubt that's the OS/package manager of choice for the target audience of Hare. Relying on OS package managers is partly why docker became popular, far more than most of the designed features of docker and the respective kernel features. The fundamental issue with security of NPM is the same issue you encounter in any package manager, you have to trust the maintainers. It's harder to trust a larger group of people than a smaller group of people. I'd argue the better solution with NPM is to choose libraries more deliberately and monitor your dependency graph instead of stopping to use NPM altogether.