4 ms·

Oh that's easy - just install 10 insecure npm packages that each install another 10 npm packages (some of which are even maintained!) then make sure you remembe

Oh that's easy - just install 10 insecure npm packages that each install another 10 npm packages (some of which are even maintained!) then make sure you remember to bundle it up in a nice, heavy electron wrapper. Then you're all ready to distribute it via some random App Store - just don't forget to charge a monthly subscription while you're at it. /s

themodelplumber 4y ago
Don't do this to me, I maintained one of these projects years ago, and am still somehow billed $0.30 a month for the privilege of the original dev having used Amazon tools for it :D
- smcleod 4y ago
  The pain is real! Speaking of Amazon - AWS CDK is promoting lots of terrible practises mostly built on barely supportable TS/JS, it's so... so terrible.
joquarky 4y ago
I've been doing web development since before the <table> tag was introduced. > just install 10 insecure npm packages that each install another 10 npm packages I still don't understand why companies are fine with this. At my last job, even principal and staff level developers needed every Windows or Mac application install vetted by IT. We had real time system monitoring on all employee workstations that ate up half the RAM and CPU resources and constantly kicked us off the VPN for even the slightest quirk (including the CPU redlining due to scanning). But npm dependencies? Nothing. Install whatever you want and push it to production. This is an S&P 500 company that deals with tons of PII.
- chclt 4y ago
  Because the working part of an organisation such as the one you describe tries to continually optimize away these restrictions. NPM (et al) is a good way to obfuscate the fact you're pulling unknown code to get shit done and processes haven't caught up yet. I'm not saying this is good, but the reality with these company-internal restrictions is, that the most productive people find ways around them and are rewarded for it.

themodelplumber 4y ago

Don't do this to me, I maintained one of these projects years ago, and am still somehow billed $0.30 a month for the privilege of the original dev having used Amazon tools for it :D

smcleod 4y ago
The pain is real! Speaking of Amazon - AWS CDK is promoting lots of terrible practises mostly built on barely supportable TS/JS, it's so... so terrible.

joquarky 4y ago

I've been doing web development since before the <table> tag was introduced. > just install 10 insecure npm packages that each install another 10 npm packages I still don't understand why companies are fine with this. At my last job, even principal and staff level developers needed every Windows or Mac application install vetted by IT. We had real time system monitoring on all employee workstations that ate up half the RAM and CPU resources and constantly kicked us off the VPN for even the slightest quirk (including the CPU redlining due to scanning). But npm dependencies? Nothing. Install whatever you want and push it to production. This is an S&P 500 company that deals with tons of PII.

chclt 4y ago
Because the working part of an organisation such as the one you describe tries to continually optimize away these restrictions. NPM (et al) is a good way to obfuscate the fact you're pulling unknown code to get shit done and processes haven't caught up yet. I'm not saying this is good, but the reality with these company-internal restrictions is, that the most productive people find ways around them and are rewarded for it.