3 ms·

lowkey ppl who praise cargo seem to have no idea of the tradeoffs involved in dependency management the difficulty of including a dependency should be proporti

lowkey ppl who praise cargo seem to have no idea of the tradeoffs involved in dependency management the difficulty of including a dependency should be proportional to the risk you're taking on, meaning it shouldn't be as difficult as it in, say, C where every other library is continually reinventing the same 5 utilities, but also not as easy as it is with npm or cargo, because you get insane dependency clutter, and all the related issues like security, build times, etc how good a build system isn't equivalent of how easy it is include a dependency, while modern languages should have a consistent build system, but having a centralised package repository that anyone freely pull to/from, and having those dependencies freely take on any number of other dependencies is a bad way to handle dependencies

itsibitzi 1y ago
What tool or ecosystem does this well, in your opinion?
- taminka 1y ago
  any language that has a standardised build system (virtually every language nowadays?), but doesn't have a centralised package repository, such that including a dependency is seamless, but takes a bit of time and intent i like how zig does this, and the creator of odin has a whole talk where he basically uses the same arguments as my original comment to reason why odin doesn't have a package manager
  - zoobab 1y ago
    "a standardised build system (virtually every language nowadays?)" Python packages still manage poorly dependencies that are in another lang like C or C++.
    - taminka 1y ago
      that's two different languages, they don't have have a standardised build system across them
quantumspandex 1y ago
Security is another problem, and should be tackled systematically. Artificially making dependency inclusion hard is not it and is detrimental to the more casual use cases.
deleted 1y ago
[deleted]
jokethrowaway 1y ago
Is your argument that python's package management & ecosystem is bad by design - to increase security? In my experience it's just bugs and poor decision making on the maintainers (eg. pytorch dropping support for intel mac, leftpad in node) or on the language and package manager developers side (py2->3, commonjs, esm, go not having a package manager, etc). Cargo has less friction than pypi and npm. npm has less friction than pypi. And yet, you just need to compromise one lone, unpaid maintainer to wreck the security of the ecosystem.
- taminka 1y ago
  nah python's package management is just straight up terrible by every metric, i just used it as a tangent to talk about how imo ppl incorrectly evaluate build systems
dev_l1x_be 1y ago
> lowkey ppl who praise cargo seem to have no idea Way to go on insulting people on HN. Cargo is literally the reason why people coming to Rust from languages like C++ where the lack of standardized tooling is giant glaring bomb crater that poses burden on people every single time they need to do some basic things (like for example version upgrades). Example: https://github.com/facebook/folly/blob/main/build.sh https://github.com/facebook/folly/blob/main/build.sh
- huflungdung 1y ago
  [dead]
- taminka 1y ago
  i'm saying that ease of dependency inclusion should not be a main criterion for evaluating how good a build system is, not that it isn't the main criterion for many people... like the entire point of my comment is that people have misguided criteria for evaluating build systems, and your comment seems to just affirm this?
  - adwn 1y ago
    > like the entire point of my comment is that people have misguided criteria for evaluating build systems, and your comment seems to just affirm this? I think dev_l1x_be's comment is meant to imply that your believe about people having misguided criteria [for evaluation build systems] is itself misguided, and that your favored approach [that the difficulty of including a dependency should be proportional to the risk you're taking on] is also misguided.
    - taminka 1y ago
      my thesis is that negative externalities of build systems are important and i don't know how to convince of importance of externalities someone whose value system is built specifically on ignoring externalities and only factoring in immediate convenience...
  - Sl1mb0 1y ago
IshKebab 1y ago
This is the weirdest excuse for Python's terrible tooling that I've ever heard. "It's deliberately shit so that people won't use it unless they really have to."
- taminka 1y ago
  i just realised that my comment sounds like it's praising python's package management since it's often so inconvenient to use, i want to mention that that wasn't my intended point, python's package management contains the worst aspects from both words: being centralised AND horrible to use lol my mistake :)
hobofan 1y ago
> but having a centralised package repository that anyone freely pull to/from, and having those dependencies freely take on any number of other dependencies is a bad way to handle dependencies So put a slim layer of enforcement to enact those policies on top? Who's stopping you from doing that?
MangoToupe 1y ago
> the difficulty of including a dependency should be proportional to the risk you're taking on Why? Dependency hell is an unsolvable problem. Might as well make it easier to evaluate the tradeoff between dependencies and productivity. You can always arbitrarily ban dependencies.

itsibitzi 1y ago

What tool or ecosystem does this well, in your opinion?

taminka 1y ago
any language that has a standardised build system (virtually every language nowadays?), but doesn't have a centralised package repository, such that including a dependency is seamless, but takes a bit of time and intent i like how zig does this, and the creator of odin has a whole talk where he basically uses the same arguments as my original comment to reason why odin doesn't have a package manager
- zoobab 1y ago
  "a standardised build system (virtually every language nowadays?)" Python packages still manage poorly dependencies that are in another lang like C or C++.
  - taminka 1y ago
    that's two different languages, they don't have have a standardised build system across them

quantumspandex 1y ago

Security is another problem, and should be tackled systematically. Artificially making dependency inclusion hard is not it and is detrimental to the more casual use cases.

deleted 1y ago

[deleted]

jokethrowaway 1y ago

Is your argument that python's package management & ecosystem is bad by design - to increase security? In my experience it's just bugs and poor decision making on the maintainers (eg. pytorch dropping support for intel mac, leftpad in node) or on the language and package manager developers side (py2->3, commonjs, esm, go not having a package manager, etc). Cargo has less friction than pypi and npm. npm has less friction than pypi. And yet, you just need to compromise one lone, unpaid maintainer to wreck the security of the ecosystem.

taminka 1y ago
nah python's package management is just straight up terrible by every metric, i just used it as a tangent to talk about how imo ppl incorrectly evaluate build systems

dev_l1x_be 1y ago

> lowkey ppl who praise cargo seem to have no idea Way to go on insulting people on HN. Cargo is literally the reason why people coming to Rust from languages like C++ where the lack of standardized tooling is giant glaring bomb crater that poses burden on people every single time they need to do some basic things (like for example version upgrades). Example: https://github.com/facebook/folly/blob/main/build.sh https://github.com/facebook/folly/blob/main/build.sh

huflungdung 1y ago
[dead]
taminka 1y ago
i'm saying that ease of dependency inclusion should not be a main criterion for evaluating how good a build system is, not that it isn't the main criterion for many people... like the entire point of my comment is that people have misguided criteria for evaluating build systems, and your comment seems to just affirm this?
- adwn 1y ago
  > like the entire point of my comment is that people have misguided criteria for evaluating build systems, and your comment seems to just affirm this? I think dev_l1x_be's comment is meant to imply that your believe about people having misguided criteria [for evaluation build systems] is itself misguided, and that your favored approach [that the difficulty of including a dependency should be proportional to the risk you're taking on] is also misguided.
  - taminka 1y ago
    my thesis is that negative externalities of build systems are important and i don't know how to convince of importance of externalities someone whose value system is built specifically on ignoring externalities and only factoring in immediate convenience...
- Sl1mb0 1y ago

IshKebab 1y ago

This is the weirdest excuse for Python's terrible tooling that I've ever heard. "It's deliberately shit so that people won't use it unless they really have to."

taminka 1y ago
i just realised that my comment sounds like it's praising python's package management since it's often so inconvenient to use, i want to mention that that wasn't my intended point, python's package management contains the worst aspects from both words: being centralised AND horrible to use lol my mistake :)

hobofan 1y ago

> but having a centralised package repository that anyone freely pull to/from, and having those dependencies freely take on any number of other dependencies is a bad way to handle dependencies So put a slim layer of enforcement to enact those policies on top? Who's stopping you from doing that?

MangoToupe 1y ago

> the difficulty of including a dependency should be proportional to the risk you're taking on Why? Dependency hell is an unsolvable problem. Might as well make it easier to evaluate the tradeoff between dependencies and productivity. You can always arbitrarily ban dependencies.