4 ms·

I don’t know the details of your particular library but I think 50k/week downloads and no problems is an outlier. In my experience even projects with small audi

I don’t know the details of your particular library but I think 50k/week downloads and no problems is an outlier. In my experience even projects with small audiences tend to accumulate outstanding bug reports faster than they’re fixed.

oliveshell 4y ago
I’m sure you’re right, but it sounds like it’s an outlier not by random chance, but because it was built carefully. I think there’s a useful lesson there.
- smaudet 4y ago
  Built carefully, extremely tiny, or single purpose. "Do one thing and do it well" - the unix philosophy, and why I still use cd, ls (dir on windows) today. If a project exceeds two functions its probably doomed to become either redundant or broken. If a project does one thing well, even if something else uses it, you can always decompose to it (your software is always useful, even when somebody writes the fancy bells and whistles version).
- jongjong 4y ago
  I can confirm that this is the norm for all my open source projects. Forward-compatibility issues can be easily avoided by not using too many dependencies and by carefully checking dependencies before using them. I check for things like over-engineering and I check out the author (check their other libraries if there are any).
- adolph 4y ago
  What non-game-able metrics do you think an outsider can use to evaluate the quality of a tool? In some ways a "perfect" tool would have no flaws (thus no issues/pull reqs) and be so easy to use (few training updates, SO questions) that it would appear to be dormant. SQLite seems to hit a good balance. There's always something new but nothing particularly breaking (from my light usage POV), so it looks live.
  - WesolyKubeczek 4y ago
    Filed issues are getting radio silence, no matter their quality. The author chimes in, says he’ll take a look next evening, then two years whoosh by. There is an ambitious todo and nothing moves. The code is in alpha for years, considered unstable, huge exclamation points in the readme that it should not be used, and yet somehow there are hundreds of reverse dependencies and it’s like this for years (usually should mean “RUN!!!”). Sometimes sneaky as it’s not a direct dependency for you, but for those two or three libraries used by like 80% of the ecosystem.
jongjong 4y ago
It's an open source pub/sub and RPC server/client (similar to gRPC) - It has a client and server component written with JavaScript and Node.js. I avoided using any dependency which relied on pre-built binaries. Also, I skim-read the code of all dependencies and made sure that they were well written and didn't use too many sub-dependencies. The trick is to minimize the number of dependencies and maximize their quality.
- tinalumfoil 4y ago
  I 100% believe that’s it’s possible to build a library without tons of bugs, and appreciate that there’s people who put out quality libraries like yours. I do think as a general heuristic no updates for 3 months means it’s been at least 2 months since anyone paid attention to outstanding bugs, especially the npm ecosystem.
  - franciscop 4y ago
    It really depends on the size and complexity of the library. Do you think something like leftPad needed updates every month to perform its function as expected and remove bugs? Of course not, the mere suggestion is ridiculous, but also something like jQuery def needs constant upkeep. In the middle, there's a world of possibilities.
    - boredtofears 4y ago
      Leftpad shouldn't exist and any library using it as a direct dependency should be treated suspiciously. I'm not saying that because of the leftpad fiasco, I mean that any library that small should simply be pasted into your codebase because the risk of managing the dependency outweighs the benefits.
      - jongjong 4y ago
        I strongly agree with this. Another set of libraries I take issues with is gulp and its plugins. I find that gulp plugins keep breaking constantly and are often flagged with vulnerabilities. The sad thing is that these plugins solve very simple problems, there is no reason for them to keep breaking every few months for the last 5 years or so. If I see a library which is supposed to solve a simple problem but it requires a large number of dependencies to do it, that's a big red flag which indicates to me that the developer who wrote it is not good enough to have their code included in my project - I don't care how popular that library is.

oliveshell 4y ago

I’m sure you’re right, but it sounds like it’s an outlier not by random chance, but because it was built carefully. I think there’s a useful lesson there.

smaudet 4y ago
Built carefully, extremely tiny, or single purpose. "Do one thing and do it well" - the unix philosophy, and why I still use cd, ls (dir on windows) today. If a project exceeds two functions its probably doomed to become either redundant or broken. If a project does one thing well, even if something else uses it, you can always decompose to it (your software is always useful, even when somebody writes the fancy bells and whistles version).
jongjong 4y ago
I can confirm that this is the norm for all my open source projects. Forward-compatibility issues can be easily avoided by not using too many dependencies and by carefully checking dependencies before using them. I check for things like over-engineering and I check out the author (check their other libraries if there are any).
adolph 4y ago
What non-game-able metrics do you think an outsider can use to evaluate the quality of a tool? In some ways a "perfect" tool would have no flaws (thus no issues/pull reqs) and be so easy to use (few training updates, SO questions) that it would appear to be dormant. SQLite seems to hit a good balance. There's always something new but nothing particularly breaking (from my light usage POV), so it looks live.
- WesolyKubeczek 4y ago
  Filed issues are getting radio silence, no matter their quality. The author chimes in, says he’ll take a look next evening, then two years whoosh by. There is an ambitious todo and nothing moves. The code is in alpha for years, considered unstable, huge exclamation points in the readme that it should not be used, and yet somehow there are hundreds of reverse dependencies and it’s like this for years (usually should mean “RUN!!!”). Sometimes sneaky as it’s not a direct dependency for you, but for those two or three libraries used by like 80% of the ecosystem.

jongjong 4y ago

It's an open source pub/sub and RPC server/client (similar to gRPC) - It has a client and server component written with JavaScript and Node.js. I avoided using any dependency which relied on pre-built binaries. Also, I skim-read the code of all dependencies and made sure that they were well written and didn't use too many sub-dependencies. The trick is to minimize the number of dependencies and maximize their quality.

tinalumfoil 4y ago
I 100% believe that’s it’s possible to build a library without tons of bugs, and appreciate that there’s people who put out quality libraries like yours. I do think as a general heuristic no updates for 3 months means it’s been at least 2 months since anyone paid attention to outstanding bugs, especially the npm ecosystem.
- franciscop 4y ago
  It really depends on the size and complexity of the library. Do you think something like leftPad needed updates every month to perform its function as expected and remove bugs? Of course not, the mere suggestion is ridiculous, but also something like jQuery def needs constant upkeep. In the middle, there's a world of possibilities.
  - boredtofears 4y ago
    Leftpad shouldn't exist and any library using it as a direct dependency should be treated suspiciously. I'm not saying that because of the leftpad fiasco, I mean that any library that small should simply be pasted into your codebase because the risk of managing the dependency outweighs the benefits.
    - jongjong 4y ago
      I strongly agree with this. Another set of libraries I take issues with is gulp and its plugins. I find that gulp plugins keep breaking constantly and are often flagged with vulnerabilities. The sad thing is that these plugins solve very simple problems, there is no reason for them to keep breaking every few months for the last 5 years or so. If I see a library which is supposed to solve a simple problem but it requires a large number of dependencies to do it, that's a big red flag which indicates to me that the developer who wrote it is not good enough to have their code included in my project - I don't care how popular that library is.