4 ms·
>> I'd love to know what you think and importantly know about any improvements you'd like us to make! I think it's scary to do any finance related stuff using
by phkahler 2y ago
>> I'd love to know what you think and importantly know about any improvements you'd like us to make!
I think it's scary to do any finance related stuff using NPM dependencies. How large is your dependency tree?
- hdshjvgiogh 2y agoThat’s what fintech is, one large dependency tree
- echelon 2y agoWith internal infosec, secinfra teams, compliance, and serious business contracts.
- lostinsauce 2y agoWith 500 MB of unversioned, arbitrary JavaScript?
- svapnil 2y agoextremely lightweight https://www.npmjs.com/package/iso20022.js?activeTab=dependencies https://www.npmjs.com/package/iso20022.js?activeTab=dependen...
- thih9 2y agoLooks like twelve libraries total. Visualized: https://npmgraph.js.org/?q=iso20022.js https://npmgraph.js.org/?q=iso20022.js
- root_axis 2y agoWhy NPM in particular? Is there any package manager where you don't have to audit your dependencies?
- lostinsauce 2y agoYes, any repository that uses maintainers and doesn't let anyone upload random stuff to it, like Debian stable. Package maintainers are the missing piece.
- katzinsky 2y agoNPM is particularly nasty because they've solved the issue of transitive dependencies having mismatched versions. This removes one of the biggest immediate pain points caused by having very large dependency graphs so you only feel the pain later on. Because of that you get this emergent behavior of unusually large dependency graphs in a lot of NPM packages.