3 ms·

Not a web guy, but that seems a bonkers default. I would have naively assumed a lockfile would be used unless explicitly ignored.

metafunctor 1y ago
Welcome to the web side. Everything’s bonkers. Hard-earned software engineering truths get tossed out, because hey, wtf, I’ll just do some stuff and yippee. Feels like everyone’s stuck at year three of software engineering, and every three years the people get swapped out.
- jiggawatts 1y ago
  > every three years the people get swapped out That's because they are being "replaced", in a sense! When an industry doubles every 5 years like web dev was for a long time, that by the mathematical definition means that the average developer has 5 years or less experience. Sure, the old guard eventually get to 10 or 15 years of experience, but they're simply outnumbered by an exponentially growing influx of total neophytes. Hence the childish attitude and behaviour with everything to do with JavaScript.
  - metafunctor 1y ago
    Good point! The web is going through its own endless September. And so, it seems, is everything else. Perhaps, this commentary adds no value — just old man yells at cloud stuff.
- anonymars 1y ago
  The web saw "worse is better" and said "hold my beer"
Already__Taken 1y ago
We didn't get locking until npm v5 (some memory and googling, could be wrong.) And it took a long time to do everything you'd think you want. Changing the main command `npm install` after 7 years isn't really "stable". Anyway didn't this replace versions, so locking won't have helped either?
- jffry 1y ago
  > Anyway didn't this replace versions, so locking won't have helped either? The lockfile includes a hash of the tarball, doesn't it?
  - thunderfork 1y ago
    [dead]
  - Already__Taken 1y ago
    It does, the answer to my question was no.
- minitech 1y ago
  You can’t replace existing versions on npm. (But probably more important is what @jffry mentioned – yes, lockfiles include hashes.)

metafunctor 1y ago

Welcome to the web side. Everything’s bonkers. Hard-earned software engineering truths get tossed out, because hey, wtf, I’ll just do some stuff and yippee. Feels like everyone’s stuck at year three of software engineering, and every three years the people get swapped out.

jiggawatts 1y ago
> every three years the people get swapped out That's because they are being "replaced", in a sense! When an industry doubles every 5 years like web dev was for a long time, that by the mathematical definition means that the average developer has 5 years or less experience. Sure, the old guard eventually get to 10 or 15 years of experience, but they're simply outnumbered by an exponentially growing influx of total neophytes. Hence the childish attitude and behaviour with everything to do with JavaScript.
- metafunctor 1y ago
  Good point! The web is going through its own endless September. And so, it seems, is everything else. Perhaps, this commentary adds no value — just old man yells at cloud stuff.
anonymars 1y ago
The web saw "worse is better" and said "hold my beer"

Already__Taken 1y ago

We didn't get locking until npm v5 (some memory and googling, could be wrong.) And it took a long time to do everything you'd think you want. Changing the main command `npm install` after 7 years isn't really "stable". Anyway didn't this replace versions, so locking won't have helped either?

jffry 1y ago
> Anyway didn't this replace versions, so locking won't have helped either? The lockfile includes a hash of the tarball, doesn't it?
- thunderfork 1y ago
  [dead]
- Already__Taken 1y ago
  It does, the answer to my question was no.
minitech 1y ago
You can’t replace existing versions on npm. (But probably more important is what @jffry mentioned – yes, lockfiles include hashes.)