7 ms·

Chill with the js hate, this happens everywhere. Maybe not to this extend, but if X (where X is whatever you are thinking about) had similar amount of people u

by zulgan 6y ago

Chill with the js hate, this happens everywhere. Maybe not to this extend, but if X (where X is whatever you are thinking about) had similar amount of people using it (especially junior people) this would happen there as well.

ddevault 6y ago
No, this does not happen everywhere. Show me this happening in Debian.
- RussianCow 6y ago
  You can't use the very latest version of any software in Debian at all without adding a custom repository, at which point you have the same issue. So the comparison is not apples to apples.
  - quantummkv 6y ago
    How about a rolling release like openSUSE tumbleweed then? I have been using it for years, I generally update once a week and I have never broken my system due to an update. Never.
  - ddevault 6y ago
    You can use Debian Unstable, or maybe just use stable and reliable dependencies so that your software is also stable and reliable. That would require putting in some effort, though, and we can't be having that, can we?
    - RussianCow 6y ago
      You can do that with NPM if you pin your dependencies to exact versions, which is the same solution that you would use for any other package manager, and basically what Debian and other Linux distros do for you. I don't know why you think this problem is somehow unique to NPM or the JavaScript ecosystem.
      - ddevault 6y ago
        And yet, somehow Debian isn't in the new every few months. There's a fundamental difference in culture, for one. But the fundamental difference in approach is there, too. Debian packages are vetted. npm packages are not.
    - snazz 6y ago
      The "slow and steady" approach works well for mature or stagnant ecosystems, but only when the packages are small enough that distribution developers can reasonably backport security fixes. That clearly doesn't work with big programs like Chrome and Firefox, so they have to resort to shipping the latest ESR version. Writing JavaScript on Debian is practically impossible without sidestepping the package manager in some way. In a lot of cases, the hacks you have to do to run up-to-date software on a distro like Debian decrease reliability significantly.
- zulgan 6y ago
  haha i understand what you mean, but debian's https://wiki.debian.org/DontBreakDebian https://wiki.debian.org/DontBreakDebian page is not an accident :) i made my comment more as a joke, shit happens everywhere, and as i said maybe not to this extend.
  - ddevault 6y ago
    All of this is telling users how to avoid breaking Debian, and mistakes that they ought to avoid. This isn't Debian being broken and the users being collateral damage. This isn't a symptom of the very Debian ecosystem itself being fundamentally broken.
    - zulgan 6y ago
      i have been using debian since potato, and i have seen some damage :D
andrewzah 6y ago
No. Other languages don't publish/import packages that are one line of code. I have never seen an issue like this with any other language that I've worked with. Any sane developer that needed a one-liner like this would just manually implement it. Not to mention that these sorts of functions are unnecessary in languages with a good stdlib or statically typed languages like rust, etc.
- exogen 6y ago
  Know what happens every time people like you say this here on HN? They post the one-liner they would have manually implemented in their code base and it's wrong. The one that comes to mind is the "is-negative-number" package. Yes, the geniuses of Hacker News, after finding out there was an npm package for determining whether something was a negative number, could not correctly implement that function. You and everyone here are not as clever as you think you are. This is why people prefer known-good implementations. The maintainer here did a bad release, big fucking deal.
  - vel0city 6y ago
    Maybe its a failure of the language when it takes a third party package to determine if a number is greater than or less than zero?
    - exogen 6y ago
      Their code would have been wrong even in strongly typed languages because it considered 0 to be a negative number. What language prevents you from making that mistake?
    - krapp 6y ago
      > Maybe its a failure of the language when it takes a third party package to determine if a number is greater than or less than zero? It's not a failure of the language. Javascript has comparison operators like every other language, it's entirely possible to determine if a number is greater than or less than zero without importing a third-party package. What it is is a failure of modern JS development culture, because apparently it's anathema to even write a simple expression on your own rather than import a dependency tree of arbitrary depth and complexity and call a function that does the same thing.
progval 6y ago
This happens because libraries installed by create-react-app depend on many other libraries (1026 transitive dependencies as of today). As a comparison, Django, a large Python web framework, has only three dependencies (pytz, sqlparse, and asgiref), which don't have dependencies themselves
- fludlight 6y ago
  pytz is a great example here. Imagine a separate package for every time zone.
- coffeefirst 6y ago
  Yeah, in 10 years of Python and front end development, this is the most fragile ecosystem. That's not a criticism of NPM, just the way it's being used today.
bdcravens 6y ago
Perhaps, but I think the JS ecosystem encourages dependency explosion like no other. Looking at a 6 or 7 year old lazily written Rails app, with a lot of functionality written throughout the years, I see about 200 gems. Creating an empty app with create-react-app, it has about 1000 packages.

by zulgan 6y ago

ddevault 6y ago

No, this does not happen everywhere. Show me this happening in Debian.

RussianCow 6y ago
You can't use the very latest version of any software in Debian at all without adding a custom repository, at which point you have the same issue. So the comparison is not apples to apples.
- quantummkv 6y ago
  How about a rolling release like openSUSE tumbleweed then? I have been using it for years, I generally update once a week and I have never broken my system due to an update. Never.
- ddevault 6y ago
  You can use Debian Unstable, or maybe just use stable and reliable dependencies so that your software is also stable and reliable. That would require putting in some effort, though, and we can't be having that, can we?
  - RussianCow 6y ago
    You can do that with NPM if you pin your dependencies to exact versions, which is the same solution that you would use for any other package manager, and basically what Debian and other Linux distros do for you. I don't know why you think this problem is somehow unique to NPM or the JavaScript ecosystem.
    - ddevault 6y ago
      And yet, somehow Debian isn't in the new every few months. There's a fundamental difference in culture, for one. But the fundamental difference in approach is there, too. Debian packages are vetted. npm packages are not.
  - snazz 6y ago
    The "slow and steady" approach works well for mature or stagnant ecosystems, but only when the packages are small enough that distribution developers can reasonably backport security fixes. That clearly doesn't work with big programs like Chrome and Firefox, so they have to resort to shipping the latest ESR version. Writing JavaScript on Debian is practically impossible without sidestepping the package manager in some way. In a lot of cases, the hacks you have to do to run up-to-date software on a distro like Debian decrease reliability significantly.
zulgan 6y ago
haha i understand what you mean, but debian's https://wiki.debian.org/DontBreakDebian https://wiki.debian.org/DontBreakDebian page is not an accident :) i made my comment more as a joke, shit happens everywhere, and as i said maybe not to this extend.
- ddevault 6y ago
  All of this is telling users how to avoid breaking Debian, and mistakes that they ought to avoid. This isn't Debian being broken and the users being collateral damage. This isn't a symptom of the very Debian ecosystem itself being fundamentally broken.
  - zulgan 6y ago
    i have been using debian since potato, and i have seen some damage :D

andrewzah 6y ago

No. Other languages don't publish/import packages that are one line of code. I have never seen an issue like this with any other language that I've worked with. Any sane developer that needed a one-liner like this would just manually implement it. Not to mention that these sorts of functions are unnecessary in languages with a good stdlib or statically typed languages like rust, etc.

exogen 6y ago
Know what happens every time people like you say this here on HN? They post the one-liner they would have manually implemented in their code base and it's wrong. The one that comes to mind is the "is-negative-number" package. Yes, the geniuses of Hacker News, after finding out there was an npm package for determining whether something was a negative number, could not correctly implement that function. You and everyone here are not as clever as you think you are. This is why people prefer known-good implementations. The maintainer here did a bad release, big fucking deal.
- vel0city 6y ago
  Maybe its a failure of the language when it takes a third party package to determine if a number is greater than or less than zero?
  - exogen 6y ago
    Their code would have been wrong even in strongly typed languages because it considered 0 to be a negative number. What language prevents you from making that mistake?
  - krapp 6y ago
    > Maybe its a failure of the language when it takes a third party package to determine if a number is greater than or less than zero? It's not a failure of the language. Javascript has comparison operators like every other language, it's entirely possible to determine if a number is greater than or less than zero without importing a third-party package. What it is is a failure of modern JS development culture, because apparently it's anathema to even write a simple expression on your own rather than import a dependency tree of arbitrary depth and complexity and call a function that does the same thing.

progval 6y ago

This happens because libraries installed by create-react-app depend on many other libraries (1026 transitive dependencies as of today). As a comparison, Django, a large Python web framework, has only three dependencies (pytz, sqlparse, and asgiref), which don't have dependencies themselves

fludlight 6y ago
pytz is a great example here. Imagine a separate package for every time zone.
coffeefirst 6y ago
Yeah, in 10 years of Python and front end development, this is the most fragile ecosystem. That's not a criticism of NPM, just the way it's being used today.

bdcravens 6y ago

Perhaps, but I think the JS ecosystem encourages dependency explosion like no other. Looking at a 6 or 7 year old lazily written Rails app, with a lot of functionality written throughout the years, I see about 200 gems. Creating an empty app with create-react-app, it has about 1000 packages.