3 ms·
Why the same advice doesn't apply to `setup.py` or `build.rs`? Is it because npm is (ab)used for software distribution (eg. see sibling comment: https://news.yc
by eitau_1 1y ago
Why the same advice doesn't apply to `setup.py` or `build.rs`? Is it because npm is (ab)used for software distribution (eg. see sibling comment: https://news.ycombinator.com/item?id=45041292 https://news.ycombinator.com/item?id=45041292) instead of being used only for managing library-dependencies?
- ivape 1y agoIt should apply for anything. Truth be told the process of learning programming is so arduous at times that you basically just copy and paste and run fucking anything in terminal to get a project setup or fixed. Go down the rabbit hole of just installing LLM software and you’ll find yourself in quite a copy and paste frenzy. We got used to this GitHub shit of setting up every process of an install script in this way, so I’m surprised it’s not happening constantly.
- username223 1y agoIt should, and also to Makefile.PL, etc. These systems were created at a time when you were dealing with a handful of dependencies, and software development was a friendlier place. Now you're dealing with hundreds of recursive dependencies, all of which you should assume may become hostile at any time. If you neither audit your dependencies, nor have the ability to sue them for damages, you're in a precarious position.
- ifwinterco 1y agoFor simple python libraries setup.py has been discouraged for a long time in favour of pyproject.toml for exactly this reason