3 ms·

For me the reason for the explosion in complexity in both frontend and backend comes down to package managers on all platforms getting way better with transitiv

by Joeri 4y ago

For me the reason for the explosion in complexity in both frontend and backend comes down to package managers on all platforms getting way better with transitive dependencies and lowering the cost of adding those dependencies. Developers used to be wary of bringing in another dependency just in case it created some conflict, but ecosystems that near-perfectly encapsulate transitive dependencies have gradually done away with that healthy wariness, with a combinatorial explosion in packages as a consequence. Create-react-app installs 1500 packages to show a hello world page, and it is quite sane in its choice of dependencies. For me this is a symptom of the whole npm ecosystem being diseased with dependicitis.

erlich 4y ago
Ironically, I think more dependencies are actually better, because it means they are smaller. "Do one thing well". The problem is large dependencies depending on other large dependencies. Dependencies should advertise their transitive dependency tree size including LOC per dep. Also, the fact that every dep has it's own non-standard build process, language, dir structure, and ESM/CJS legacy support, makes things not ideal.
- lolinder 4y ago
  > Ironically, I think more dependencies are actually better, because it means they are smaller. "Do one thing well". I could believe this if I thought that having 1500 dependencies led to less code overall, but the size of my node_modules folder shows that assumption to be flawed. The other problem with this argument is that each dependency you add is another set of developers that you are depending on. It's another group of people who could suddenly pull a left pad or worse, and it's another group of people who you have to trust to have written secure code. The fewer dependencies I have, the smaller my chances of being exploited because of a people problem.

by Joeri 4y ago

erlich 4y ago

Ironically, I think more dependencies are actually better, because it means they are smaller. "Do one thing well". The problem is large dependencies depending on other large dependencies. Dependencies should advertise their transitive dependency tree size including LOC per dep. Also, the fact that every dep has it's own non-standard build process, language, dir structure, and ESM/CJS legacy support, makes things not ideal.

lolinder 4y ago
> Ironically, I think more dependencies are actually better, because it means they are smaller. "Do one thing well". I could believe this if I thought that having 1500 dependencies led to less code overall, but the size of my node_modules folder shows that assumption to be flawed. The other problem with this argument is that each dependency you add is another set of developers that you are depending on. It's another group of people who could suddenly pull a left pad or worse, and it's another group of people who you have to trust to have written secure code. The fewer dependencies I have, the smaller my chances of being exploited because of a people problem.