3 ms·
The Node team has lost the plot IMO. By far the most critical issue is the over reliance on third party NPM packages for even fundamental needs like connecting
by pier25 7mo ago
The Node team has lost the plot IMO.
By far the most critical issue is the over reliance on third party NPM packages for even fundamental needs like connecting to a database.
- afavour 7mo agoWhat would a Node-native database connection layer look like? What other platforms have that? Databases are third party tech, I don’t think it’s unreasonable to use a third party NPM module to connect to them.
- ksherlock 7mo agoPerl has DBI. PHP has PDO.
- Spivak 7mo agoPython has DB-API.
- mike_hearn 7mo agoMost obviously, Java has JDBC. I think .NET has an equivalent. Drivers are needed but they're often first party, coming directly from the DB vendor itself. Java also has a JIT compiling JS engine that can be sandboxed and given a VFS: https://www.graalvm.org/latest/security-guide/sandboxing/ https://www.graalvm.org/latest/security-guide/sandboxing/ N.B. there's a NodeJS compatible mode, but you can't use VFS+sandboxing and NodeJS compatibility together because the NodeJS mode actually uses the real NodeJS codebase, just swapping out V8. For combining it all together you'd want something like https://elide.dev https://elide.dev which reimplemented some of the Node APIs on top of the JVM, so it's sandboxable and virtualizable.
- LunaSea 7mo ago> Most obviously, Java has JDBC. I think .NET has an equivalent. Drivers are needed but they're often first party, coming directly from the DB vendor itself. So it's an external dependency that is not part of Java. It doesn't really matter if the code comes from the vendor or not. Especially for OpenSource databases.
- mike_hearn 7mo agoWell in the case of Oracle you can get the language, runtime, DB and driver all from the same organization under unified support contracts. If you don't value that, why would you want your programming language implementors to also implement database drivers?
- zadikian 7mo agoWell that's only because Oracle happens to own both Java and Oracle DB. Suppose you're not using that DB.
- zadikian 7mo agoDBMS vendor providing the client is nice. At least if you're using pg-native in Node, that's just a wrapper around the Postgres-owned libpq, but I've run into small breaking updates before that I don't feel would've happened if Postgres maintained both.
- afavour 7mo agoBut that’s not Node’s fault surely? Shouldn’t Postgres be providing an NPM module given the popularity of Node?
- zadikian 7mo agoNo it's not Node's fault, this isn't their job. I don't blame Postgres either, cause maintaining libpq is fair enough, just would've been extra nice to have an official Node lib too.
- pier25 7mo agoBun provides native MySQL, SQlite, and Postgres drivers. I'm not saying Node should support every db in existence but the ones I listed are critical infrastructure at this point. When using Postgres in Node you either rely on the old pg which pulls 13 dependencies[1] or postgres[2] which is much better and has zero deps but mostly depends on a single guy. [1] https://npmgraph.js.org/?q=pg https://npmgraph.js.org/?q=pg [2] https://github.com/porsager/postgres https://github.com/porsager/postgres
- adzm 7mo agoNode has sqlite, though I have not had any issues using better-sqlite3 and worker processes for long running ops
- pier25 7mo agoUntil the day it gets pwned by a malicious actor. Which is something we've seen quite a lot of times on npm deps.
- zadikian 7mo agoMaybe MySQL and Postgres should make official Node libs then. Bun maintaining this is ok too, but it seems odd given that it means having to keep up with new features in those DBMSes.
- pier25 7mo ago> but it seems odd given that it means having to keep up with new features in those DBMSes That would be more useful for the ecosystem than the Node team investing time on a virtual file system.
- zadikian 7mo agoHard to compare, but reason #1 of bundling an app is a pretty big deal that can't be solved with just a library.
- beart 7mo agoOutside of sqlite, what runtimes natively include database drivers?
- pier25 7mo agoBun, .NET, PHP, Java
- LunaSea 7mo agoFor Bun you're thinking of simple key / values, hardly a database. They also have a SQLite driver which is still just a package.
- pier25 7mo agoI think you're confusing the database engine with the driver?
- Deukhoofd 7mo agoFor .NET only the old legacy .NET Framework, SqlClient was moved to a separate package with the rewrite (from System.Data.SqlClient to Microsoft.Data.SqlClient). They realized that it was a rather bad idea to have that baked in to your main runtime, as it complicates your updates.
- pier25 7mo agoIt's still provided by Microsoft. They are responsible for those first party drivers.
- nulltrace 7mo agoI publish a package with zero deps and people still pull in a pile of transitive stuff from their lockfile. "pg" has 13 dependencies and nobody even blinks. One gets compromised and suddenly every Node backend using Postgres is in scope. Bun shipping native drivers feels like the right call, fewer moving parts.
- NoNameProvided 7mo agoI understand the general point you're making, but the pg package isn’t a good example. It has 6 deps, not 13, and 5 of those are internal packages from the same monorepo without additional dependencies. There’s only a single external dependency, and that one brings in just one additional package. In my opinion, the pg repo and packages are an example of how OSS stuff should be maintained. Clean repo, clean code, well-maintained readme, and clearly focus on keeping things simple instead of overcomplicating.