4 ms·

I always wondered why people found it acceptable to just run npm on their systems for anything they do, and have it download anything on any build. Coming from

by jwr 1y ago

I always wondered why people found it acceptable to just run npm on their systems for anything they do, and have it download anything on any build. Coming from "make" with repeatable and predictable builds, I was appalled that you run this thing and you have no idea what it will download and what it will produce. Could be something different the next time you run it! Who knows! I also found it bizarre that even for things that just generate CSS, you are expected to integrate it into your npm thing. I mean, generating CSS from a configuration is a function. It's a make recipe. Why does it need to be an npm library dependency with all the associated mess? I managed to work around it for a number of packages by freezing entire npm setups inside docker containers, which gave me reproducible builds — but it's a losing battle.

gear54rus 1y ago
> entire npm setups inside docker containers Did you then spend a month or two inspecting that setup? Did you do that after every dependency upgrade? Also both NPM and PNPM already freeze dependencies for you by default without any arcane docker setups.
- jwr 1y ago
  > Did you then spend a month or two inspecting that setup? Did you do that after every dependency upgrade? TBH, I never updated some of the setups. What's the point? Their job was to generate a CSS. Why would I want to upgrade dependencies or inspect that setup? > arcane docker setups I take issue with "arcane" — I have much more "arcane" setups than these :-)
Havoc 1y ago
The entire Front end dev seems like trust me bro Wild West to me. All feels like endless layers of duct tape. Which I guess in a way it is given the evolution of browsers
- graemep 1y ago
  it seems a lot worse with NPM for some reason, but the underlying weaknesses apply to language package managers in general too.
  - johnisgood 1y ago
    I think it is worse with npm because there are more people using it and more people know about it. Lowering the barrier to entry is not paying off, for sure.
  - quails8mydog 1y ago
    I think part of the reason is the embrace of an "each package should do exactly one thing" by many in the community, often taken to a ridiculous extreme. Possibly better now after left-pad and other similar incidents.
- augusto-moura 1y ago
  This is true for every moser package manager out there: pip, cargo, gradle and the lot. It is not about front end dev
- nightski 1y ago
  I've seen gnarly code everywhere, from kernel drivers to desktop applications to web apps. At the end of the day this describes most of computing imho.
TZubiri 1y ago
'Npm install thing' is easier than programming or even auditing imported code. Too lazy to write, too cheap to pay for it, that's half of open source. Now what's going to dominate stackoverflow answers, thoughtful articles on how to program? Or gratis npm/uv installable libraries that hide the actual solution details in between tests and polyfills and readmes, that end up just download another dependency while contributing enough lines of code so that the author can safely put it in their resume and grift over the oss ecosystem to get a cushy 300k/yr job at an extended faang where they are in charge of an ad pixel tracker or yet another one of those wallet things that are just an IO proxy for money but they get to keep some comission if they spend enough money on ads to convince someone to use the thing once and then it becomes their main neo(not) bank* forever. *for regulatory reasons we must not call it a bank, but it's a bank
augusto-moura 1y ago
Downloading things that you don't know about its common for every modern package manager out there, from maven, to nuget, to pip and npm. This is the new norm and there are reasons for it. I don't think the old C/C++ way of relying on distro package managers would allow for the fast ecosystems people work nowadays. Things are changing though, and people are pushing for more secure package managers with the same feature set as the old ones, which is possible. I think this is the missing piece on the first wondering part of your comment. But I don't think we should be bashing the means without understanding the reasons
pluto_modadic 1y ago
makefiles /can/ do whatever you like. They can download anything on build.
alt227 1y ago
> freezing entire npm setups inside docker containers, which gave me reproducible builds How does that work when enevitably those npm packages are shown to have vulnerabilites?

by jwr 1y ago

gear54rus 1y ago

> entire npm setups inside docker containers Did you then spend a month or two inspecting that setup? Did you do that after every dependency upgrade? Also both NPM and PNPM already freeze dependencies for you by default without any arcane docker setups.

jwr 1y ago
> Did you then spend a month or two inspecting that setup? Did you do that after every dependency upgrade? TBH, I never updated some of the setups. What's the point? Their job was to generate a CSS. Why would I want to upgrade dependencies or inspect that setup? > arcane docker setups I take issue with "arcane" — I have much more "arcane" setups than these :-)

Havoc 1y ago

The entire Front end dev seems like trust me bro Wild West to me. All feels like endless layers of duct tape. Which I guess in a way it is given the evolution of browsers

graemep 1y ago
it seems a lot worse with NPM for some reason, but the underlying weaknesses apply to language package managers in general too.
- johnisgood 1y ago
  I think it is worse with npm because there are more people using it and more people know about it. Lowering the barrier to entry is not paying off, for sure.
- quails8mydog 1y ago
  I think part of the reason is the embrace of an "each package should do exactly one thing" by many in the community, often taken to a ridiculous extreme. Possibly better now after left-pad and other similar incidents.
augusto-moura 1y ago
This is true for every moser package manager out there: pip, cargo, gradle and the lot. It is not about front end dev
nightski 1y ago
I've seen gnarly code everywhere, from kernel drivers to desktop applications to web apps. At the end of the day this describes most of computing imho.

TZubiri 1y ago

'Npm install thing' is easier than programming or even auditing imported code. Too lazy to write, too cheap to pay for it, that's half of open source. Now what's going to dominate stackoverflow answers, thoughtful articles on how to program? Or gratis npm/uv installable libraries that hide the actual solution details in between tests and polyfills and readmes, that end up just download another dependency while contributing enough lines of code so that the author can safely put it in their resume and grift over the oss ecosystem to get a cushy 300k/yr job at an extended faang where they are in charge of an ad pixel tracker or yet another one of those wallet things that are just an IO proxy for money but they get to keep some comission if they spend enough money on ads to convince someone to use the thing once and then it becomes their main neo(not) bank* forever. *for regulatory reasons we must not call it a bank, but it's a bank

augusto-moura 1y ago

Downloading things that you don't know about its common for every modern package manager out there, from maven, to nuget, to pip and npm. This is the new norm and there are reasons for it. I don't think the old C/C++ way of relying on distro package managers would allow for the fast ecosystems people work nowadays. Things are changing though, and people are pushing for more secure package managers with the same feature set as the old ones, which is possible. I think this is the missing piece on the first wondering part of your comment. But I don't think we should be bashing the means without understanding the reasons

pluto_modadic 1y ago

makefiles /can/ do whatever you like. They can download anything on build.

alt227 1y ago

> freezing entire npm setups inside docker containers, which gave me reproducible builds How does that work when enevitably those npm packages are shown to have vulnerabilites?