3 ms·
> npm or pip, in order to get things working properly. Yes, this is one large difference between development at Google vs most other companies. https://opensou
by tylerhou 4y ago
> npm or pip, in order to get things working properly.
Yes, this is one large difference between development at Google vs most other companies. https://opensource.google/documentation/reference/thirdparty https://opensource.google/documentation/reference/thirdparty
Personally I think this is what companies should do -- it guarantees hermeticity as you say, guards against NPM repo deletion (left-pad) and supply chain attacks. But for people who are used to just `npm install` there is a lot more overhead.
- rtpg 4y agopersonally I don't think there is that much value in society in endlessly vendoring exactly the same code in various places. This is why we have checksums! I understand that Google will do this stuff to remove certain stability issues (and I imagine they have their own patches!), but I don't think that this is the fundamental issue relative to practical integration issues that are solvable but tedious. EDIT:I do think people have reasons for doing vendoring, of course, I don't think that it should be the default behavior unless you have a good reason.