5 ms·
If anything, the left-pad debacle has shown that NPM package granularity has gone way too small, at a point where package overhead was outweighing the package s
by 0xAFFFF 1y ago
If anything, the left-pad debacle has shown that NPM package granularity has gone way too small, at a point where package overhead was outweighing the package simplicity benefits.
- whostolemyhat 1y agoLeft-pad was made at a time when tree-shaking wasn't really around, so it was good practice to only include the functions you needed to avoid making websites too heavy. If you just needed a small function then it'd be silly to include a huge utility library like Underscore.
- yurishimo 1y agoYou're missing the point. Nobody with a serious background in software development should ever need to pull in a package to pad a string or check if a number is even or odd. If someone is smart enough to use a package manager, they should be more than capable to write a function to pad a string (assuming the standard library doesn't include one already)!
- baobabKoodaa 1y agoWhile you are correct, the problem compounds when popular package developers choose to use tiny packages. I don't need left-pad. But maybe I need react-starter-kit. Now, imagine that react-starter-kit has a dependency to markdown-js-blobber, which has a dependency to make-text-nice, which has a dependency to left-pad. In this scenario I am now "pulling in a package to pad a string". If I am "smart enough to use a package manager", I should be "more than capable to write..." an alternative to react-starter-kit..?
- jstanley 1y agoThe onus there is on the "make-text-nice" developer, not an eventual user of "make-text-nice".
- yurishimo 1y agoI don't place any blame here on the person using `react-starter-kit` and I think you're being a bit obtuse to suggest otherwise. It's the original person who pulled in a package for <10 lines of code who is to blame.
- baobabKoodaa 1y agoI provided the real reason for the high download counts of these packages.
- gpiancastelli 1y agoHowever, JavaScript never had a proper standard library. Combine this to mainstream education teaching that you should always reuse code when possible instead of "reinventing the wheel", and web shops agreeing to it because "using libraries saves time", and it's easy to understand the "popularity" of left-pad. To a certain extent, and to the best of my knowledge, those things haven't really changed.
- eviks 1y agoHow does serious background help the argument for wasting your time writing code that's already been written. By the way, why should serious people use padding from the standard library?
- yurishimo 1y agoI would argue that a leftpad/is-odd package is the equivalent of writing a for loop. The time it cost you to search the internet, download the package, and rerun your build script cost more than the time to write the function from scratch and the behavior is indentical. Duplicate code across the ecosystem is fine. Not every function must be unique for an entire programming language.
- eviks 1y agoWhat about the time it cost you to search the internet, read the docs, and use the one from std? How many seconds does each variant take (with hot/cold memory cache?) And the behavior could also be worse, there is no guarantee of perfection. The last argument is too generic to offer any guidance. Why is it better for this function be duplicated?? Should it not be part of std to avoid uniqueness?
- beej71 1y agoThe standard library is a far less risky dependency than third-party libraries. It's far more reliable in presence and behavior.
- eddd-ddde 1y agoIronically I feel like this is something LLMs will improve. Now anyone can type "create left pad function" and it will essentially just vendor in the existing code.
- layer8 1y agoWhat does the size or granularity have to do with the incident? If the author had combined all his 350+ packages into one (or had had a more comprehensive text-utils.js package) and pulled that instead, the issue would have been at least as severe? I don’t think such small packages are sensible, in particular when versioned separately, but I also don’t see how the left-pad debacle has shown that.
- baobabKoodaa 1y ago[flagged]
- anonymars 1y agoInstead of teasing, can you just tell us what the difference is between unpublishing N small packages versus one large package containing the same set of functionality?
- baobabKoodaa 1y agoWell, I sure can! When you develop software by gluing together 1000000 small packages, you now have 1000000 points of failure. When you develop software by... you know, writing trivial things by yourself instead of downloading a package... you have maybe 100 points of failure instead of 1000000 points of failure. Having 100 points of failure is better than having 1000000 points of failure. Note that in this example you are writing trivial things by yourself instead of adding a package. So we're not taking the same set of code as dependencies, slicing it into different number of slices, instead we're taking less code as dependencies.
- layer8 1y agoI don’t quite follow the reasoning. You can reverse the argument: When one package breaks, then — all else being equal — more dependents are likely to be affected if it is a large package with many functions than if it is a tiny package with just one function. What made the left-pad incident prominent is that the package had so many dependents. That’s due to how frequently its functionality is useful, not due to its size. And in general these are inversely correlated characteristics. Yet another argument: If any given function breaks, then the affected dependents are invariant under the granularity of packaging. Exactly those dependents will break that make use of the given function, regardless of the packaging. The one argument I could buy is that depending on a larger number of packages increases the likelihood of depending on unreliable maintainers. Still, in the case of left-pad that isn’t entirely convincing, since the maintainer in question maintained so many packages.