3 ms·
Nobody is saying NPM is unique - it’s one end of a spectrum but that doesn’t mean everything else is completely on the other end - for example, this study found
by acdha 2mo ago
Nobody is saying NPM is unique - it’s one end of a spectrum but that doesn’t mean everything else is completely on the other end - for example, this study found Maven projects having almost as many dependencies on average as NPM, both well ahead of everything else:
https://arxiv.org/html/2512.14739v1 https://arxiv.org/html/2512.14739v1
Again, this is about culture rather than some innate flaw. Dependencies are about trust and I suspect that future developers are going to be amazed at how casually people ran code from strangers, similar to how stories about unprotected 70s swinger parties sound incredibly reckless to almost people who grew up after decades of HIV awareness campaigns.
- insanitybit 2mo ago> No way to prevent this says only package manager where this regularly happens "only"
- acdha 2mo agoThat’s a joke referring to The Onion, not a serious analysis: https://theonion.com/no-way-to-prevent-this-says-only-nation-where-this-r-1848971668/ https://theonion.com/no-way-to-prevent-this-says-only-nation...
- insanitybit 2mo agoHow much am I expected to charitably interpret the joke? They said "only", I'm taking it at face value because it's obviously intended to be commentary and the obvious implication is that this issue is unique to NPM (as that's the whole point of the Onion article). I'm well aware of the Onion reference.