5 ms·

> Yeah, and then what happens if you want to use modern syntax like esmodule, or maybe you want to use types with typescript? You are going to have to use npm.

> Yeah, and then what happens if you want to use modern syntax like esmodule, or maybe you want to use types with typescript? You are going to have to use npm. I don't understand what the problem is here? Every installation of Node comes bundled with npm. If it doesn't, that is a package maintenance problem. > Fun fact: One of the understated features go run is that it will automatically download any dependencies the code references; how cool is that! This feels like a massive antipattern. Why is this lauded as a "feature"? Why do I want my build system to automatically reach out to the Internet and download random code, without an explicit request to do so like "npm install"? This is even more antipattern-ish when you consider that Go dependencies are literally just repos on Github (or possibly on some random git server), instead of a centralized and moderated registry like npmjs.org. > amazing, for js we not only have npm, yarn, pnpm, and bower (am I missing any?) but we also have completely new runtimes bun and deno. So it's now considered bad to have multiple implementations of an open standard, compared to the exclusively-Google-developed Go runtime? This sounds akin to arguing in favor of a monopoly over a competitive market with consumer choice.

asp_hornet 3y ago
Everyone who clones a node project will call npm install before the call npm run. Having a seperate install command doesnt make it more secure, it just makes 1 more thing for newbies to learn and another thing to go wrong when you pull master and someone added a package and you called run without installing again.
- lopkeny12ko 3y ago
  If you pull a Node project that depends on malware, "npm install" will fail, assuming npmjs has unpublished or withdrawn the malicious package. There is no such safeguard when your dependency system downloads random code from random git repos. Even worse so when this is done automatically, when a developer doesn't expect a command to do so. If I run a command that depends on a third party library or resource, and I don't have that library, I fully expect it to fail. Is that not basically universal behavior in Unix?
  - MrDarcy 3y ago
    The go global module proxy serves the same purpose as you describe with npm. https://proxy.golang.org/ https://proxy.golang.org/ The Go team is providing the following services run by Google: a module mirror for accelerating Go module downloads, an index for discovering new modules, and a global go.sum database for authenticating module content.
duped 3y ago
> So it's now considered bad to have multiple implementations of an open standard Seeing how many CPU cycles have been wasted on autoconf generating code and testing for various ancient/obsolete C compilers and configurations has taught me that yes, it's not a good thing to have multiple slightly incompatible implementations.
ilovejava 3y ago
Thank you for saying this!
badrequest 3y ago
> This feels like a massive antipattern. Why is this lauded as a "feature"? Why do I want my build system to automatically reach out to the Internet and download random code, without an explicit request to do so like "npm install"? It's not random code, it's code you've expressly used.
- dgb23 3y ago
  Plus, there's likely far less "random" code in the tree, due to go packages generally having fewer dependencies. It's a cultural thing, yes, but it's there in practice.
breadchris 3y ago
> I don't understand what the problem is here. Every installation of Node comes bundled with npm. If it doesn't, that is a package maintenance problem. Node and npm are two commands, and when you go to find packages, you will see people telling you to use pnpm, yarn, or npm. I would expect one tool to do this for me, especially for the most popular language in the world. > This feels like a massive antipattern. Why is this lauded as a "feature"? Why do I want my build system to automatically reach out to the Internet and download random code without an explicit request, like "npm install"? https://chat.openai.com/share/8bd82c15-c939-4e82-aad8-086995f06a2c https://chat.openai.com/share/8bd82c15-c939-4e82-aad8-086995... > This is even more antipattern-ish when you consider that Go dependencies are just repoed on GitHub (or possibly on some random git server) instead of a centralized and moderated registry like npmjs.org. I find this to lend itself to a more decentralized future. I see notable projects owning their code and distributing it positively. You still need the source code for something to run at the end of the day. If you are worried about the code continuing to be there, that is the purpose of a proxy cache, which makes it very easy: https://proxy.golang.org/ https://proxy.golang.org/. Also, the code is distributed on github. So, if github working is a concern, we probably have much bigger problems. > So it's now considered harmful to have multiple implementations of an open standard, compared to the exclusively Google-developed Go runtime? This sounds akin to arguing for a monopoly over a competitive market with consumer choice. A hammer looks like a hammer because that is the most effective way to hit a nail. Since I am "building" code, I want my tools to feel as reliable as a hammer. I will not argue that Go is the best language ever invented; I see it as the most accessible language to make things happen fast and reliably until a better one emerges. When that happens, AI-generated refactoring tools will be so good, and Go code is so quickly parseable that I will let it loose in my Go code bases to refactor them into that language.
- febusravenga 3y ago
  Hammer is not screwdriver. you want screwdriver and hammer to blend into one tool. Does your hammer has built-in car or drone to bring nails from store? No. that's why some people think that it's reasonable to split programs that have different modes if operations. Your choice, but note that it's not universally accepted true or demand.
- 3y ago
kunley 3y ago
> Every installation of Node comes bundled with npm. If it doesn't, that is a package maintenance problem. Not really. Ubuntu's node comes without npm, and to install the latter it wants to get about a hundred of dependencies. Mind you, this is still one of the most popular distros. Would you call their approach "a problem"?
- lopkeny12ko 3y ago
  This is not true. Installing Node on Ubuntu with a package manager using the official instructions [0] installs both Node and npm. If you are using an unofficial repository, and that maintainer did not include npm in his Node package, then yes I would consider that a problem. > to install the latter it wants to get about a hundred of dependencies Yeah, as software engineers, let's discourage code reuse, shall we? Node and npm are not trivial pieces of software. I expect it to have lots of dependencies. This is hardly surprising. [0] https://nodejs.org/en/download/package-manager#debian-and-ubuntu-based-linux-distributions https://nodejs.org/en/download/package-manager#debian-and-ub...

asp_hornet 3y ago

Everyone who clones a node project will call npm install before the call npm run. Having a seperate install command doesnt make it more secure, it just makes 1 more thing for newbies to learn and another thing to go wrong when you pull master and someone added a package and you called run without installing again.

lopkeny12ko 3y ago
If you pull a Node project that depends on malware, "npm install" will fail, assuming npmjs has unpublished or withdrawn the malicious package. There is no such safeguard when your dependency system downloads random code from random git repos. Even worse so when this is done automatically, when a developer doesn't expect a command to do so. If I run a command that depends on a third party library or resource, and I don't have that library, I fully expect it to fail. Is that not basically universal behavior in Unix?
- MrDarcy 3y ago
  The go global module proxy serves the same purpose as you describe with npm. https://proxy.golang.org/ https://proxy.golang.org/ The Go team is providing the following services run by Google: a module mirror for accelerating Go module downloads, an index for discovering new modules, and a global go.sum database for authenticating module content.

duped 3y ago

> So it's now considered bad to have multiple implementations of an open standard Seeing how many CPU cycles have been wasted on autoconf generating code and testing for various ancient/obsolete C compilers and configurations has taught me that yes, it's not a good thing to have multiple slightly incompatible implementations.

ilovejava 3y ago

Thank you for saying this!

badrequest 3y ago

> This feels like a massive antipattern. Why is this lauded as a "feature"? Why do I want my build system to automatically reach out to the Internet and download random code, without an explicit request to do so like "npm install"? It's not random code, it's code you've expressly used.

dgb23 3y ago
Plus, there's likely far less "random" code in the tree, due to go packages generally having fewer dependencies. It's a cultural thing, yes, but it's there in practice.

breadchris 3y ago

> I don't understand what the problem is here. Every installation of Node comes bundled with npm. If it doesn't, that is a package maintenance problem. Node and npm are two commands, and when you go to find packages, you will see people telling you to use pnpm, yarn, or npm. I would expect one tool to do this for me, especially for the most popular language in the world. > This feels like a massive antipattern. Why is this lauded as a "feature"? Why do I want my build system to automatically reach out to the Internet and download random code without an explicit request, like "npm install"? https://chat.openai.com/share/8bd82c15-c939-4e82-aad8-086995f06a2c https://chat.openai.com/share/8bd82c15-c939-4e82-aad8-086995... > This is even more antipattern-ish when you consider that Go dependencies are just repoed on GitHub (or possibly on some random git server) instead of a centralized and moderated registry like npmjs.org. I find this to lend itself to a more decentralized future. I see notable projects owning their code and distributing it positively. You still need the source code for something to run at the end of the day. If you are worried about the code continuing to be there, that is the purpose of a proxy cache, which makes it very easy: https://proxy.golang.org/ https://proxy.golang.org/. Also, the code is distributed on github. So, if github working is a concern, we probably have much bigger problems. > So it's now considered harmful to have multiple implementations of an open standard, compared to the exclusively Google-developed Go runtime? This sounds akin to arguing for a monopoly over a competitive market with consumer choice. A hammer looks like a hammer because that is the most effective way to hit a nail. Since I am "building" code, I want my tools to feel as reliable as a hammer. I will not argue that Go is the best language ever invented; I see it as the most accessible language to make things happen fast and reliably until a better one emerges. When that happens, AI-generated refactoring tools will be so good, and Go code is so quickly parseable that I will let it loose in my Go code bases to refactor them into that language.

febusravenga 3y ago
Hammer is not screwdriver. you want screwdriver and hammer to blend into one tool. Does your hammer has built-in car or drone to bring nails from store? No. that's why some people think that it's reasonable to split programs that have different modes if operations. Your choice, but note that it's not universally accepted true or demand.
3y ago

kunley 3y ago

> Every installation of Node comes bundled with npm. If it doesn't, that is a package maintenance problem. Not really. Ubuntu's node comes without npm, and to install the latter it wants to get about a hundred of dependencies. Mind you, this is still one of the most popular distros. Would you call their approach "a problem"?

lopkeny12ko 3y ago
This is not true. Installing Node on Ubuntu with a package manager using the official instructions [0] installs both Node and npm. If you are using an unofficial repository, and that maintainer did not include npm in his Node package, then yes I would consider that a problem. > to install the latter it wants to get about a hundred of dependencies Yeah, as software engineers, let's discourage code reuse, shall we? Node and npm are not trivial pieces of software. I expect it to have lots of dependencies. This is hardly surprising. [0] https://nodejs.org/en/download/package-manager#debian-and-ubuntu-based-linux-distributions https://nodejs.org/en/download/package-manager#debian-and-ub...