3 ms·
Yeah, my point is just that other package managers aren't in a great spot. NPM even lets you separate out "publish" and "release" now where you can publish to t
by insanitybit 2mo ago
Yeah, my point is just that other package managers aren't in a great spot. NPM even lets you separate out "publish" and "release" now where you can publish to the registry but you have to separately "ack" that to release. That's kinda a huge win if people use it.
I just think the framing that npm is so bad is really flatly invalid.
- altcognito 2mo ago> the framing that npm is so bad is really flatly invalid. Is it really though if we're getting thousands of compromised packages regularly? You can do all the right things and still be legit problematic.
- insanitybit 2mo agoYes, it has nothing to do with the design of npm (relative to similar languages/ repositories) and everything to do with the popularity.
- woodruffw 2mo agoI don’t think npm itself is measurably bad in ways that are useful to index on. Like others, I think that JS as an ecosystem has a culture that encourages both dependency sprawl and living at the edge, both of which contribute to the end problem of OSS malware. (Rust has a similar culture, to be clear. I don’t think it’s a death knell.)