3 ms·

On one hand that's certainly true. On the other: Do you care how $LIB does some work for you? Does it matter to you whether $LIB uses $OTHERLIB in version 0.1 o

by pilif 13y ago

On one hand that's certainly true. On the other: Do you care how $LIB does some work for you? Does it matter to you whether $LIB uses $OTHERLIB in version 0.1 or 0.2? Does it matter to you whether $LIB bundles $OTHERLIB as a package or whether it just includes the source code of $OTHERLIB? Yes. I see the security implications of running an outdated $OTHERLIB, but that's $LIB's responsibility, no matter whether they include a copy of $OTHERLIB as its own package in a subdirectory or whether they just copy $OTHERLIB into their own code base. Once you bundle dependencies, you're responsible for security holes in them. The other issue of course is RAM usage once you start running multiple identical copies of $OTHERLIB, but that's only if they use identical versions. If it's different versions, you will have to run multiple copies at once or you risk breaking your dependencies. Or you don't run at all (Bundler's "solution")

stormbrew 13y ago
I'm not sure there's any universal answer to the questions you pose in your first paragraph. The problem is that sometimes you do care (sometimes a library is actually an interface into some kind of stateful machine) and sometimes you don't (when it's just objects that hold their own state). To some extent javascript gets a bit of a free ride on this question because most libraries are designed around there being only one global state machine (the event loop), but ruby doesn't impose an execution model on you.
- plorkyeran 13y ago
  Yeah, I think npm's model is the correct one for node, but it's not universally better than all others by any means. It's not possible at all in many languages, would result in absurd compilation times and disk space usage in compiled languages, and makes security audits much more difficult. It's certainly not very compatible with an environment where every dependency requires external approval.
jrochkind1 13y ago
> Do you care how $LIB does some work for you? Does it matter to you whether $LIB uses $OTHERLIB in version 0.1 or 0.2? Only when debugging. But that's a pretty big 'only when'

by pilif 13y ago

stormbrew 13y ago

I'm not sure there's any universal answer to the questions you pose in your first paragraph. The problem is that sometimes you do care (sometimes a library is actually an interface into some kind of stateful machine) and sometimes you don't (when it's just objects that hold their own state). To some extent javascript gets a bit of a free ride on this question because most libraries are designed around there being only one global state machine (the event loop), but ruby doesn't impose an execution model on you.

plorkyeran 13y ago
Yeah, I think npm's model is the correct one for node, but it's not universally better than all others by any means. It's not possible at all in many languages, would result in absurd compilation times and disk space usage in compiled languages, and makes security audits much more difficult. It's certainly not very compatible with an environment where every dependency requires external approval.

jrochkind1 13y ago

> Do you care how $LIB does some work for you? Does it matter to you whether $LIB uses $OTHERLIB in version 0.1 or 0.2? Only when debugging. But that's a pretty big 'only when'