4 ms·
> And cargo and npm show just how unnecessary all that pain is in C! Leftpad would like a word. Every dependency is a liability. It's another thing to vet, an
by patrick451 3y ago
> And cargo and npm show just how unnecessary all that pain is in C!
Leftpad would like a word.
Every dependency is a liability. It's another thing to vet, another thing which can disappear. Having few dependencies in c is a feature, not a bug. The approach to dependencies in rust was a major turn off to me. I recall 15 just to get random numbers in the intro tutorial. No thanks.
- josephg 3y agoJust in case you don’t know, packages can no longer be pulled from npm by the developer. At least not without emailing someone. And you need a very good reason - like that version is ransomware. The particular pulled package version identifier (foo@1.0.1) can also never be reused. If you audit 1.0.1, it will never change out from under you. The leftpad fiasco was hilarious and embarrassing. But it can’t happen again because of changes in npm policy.