7 ms·

The Author isn't arguing for not using third party dependencies. He's arguing for developers to be more conscious of the dependencies they use, by manually vett

by 1GZ0 1y ago

The Author isn't arguing for not using third party dependencies. He's arguing for developers to be more conscious of the dependencies they use, by manually vetting and handling them. That screams "I've been down the package manager route and paid the price". Not inexperience.

pipes 1y ago
But titled the post "package managers are evil"
- Defletter 1y ago
  > The term “evil” is being used partially hyperbolic to make a point. Kind of bonkers this even needs to be said, and even then it's missed/ignored.
  - rgoulter 1y ago
    The title is provocative and attention grabbing. -- It's completely fair game to react to the provocation rather than the substance of the article itself. (Or, rather, it's silly to use attention grabbing rhetoric, then complain that people paid attention to the rhetoric). I'd prefer instead a more balanced title like "Remember to Consider the Costs When Using Package Managers", or whatever.
    - gingerBill 1y ago
      The title of the article comes from the direct words I said in the video, of which the article is effectively a polished transcription of. Your "more balanced title" isn't even close to what I am saying. I am saying that Package Managers are just bad and should not be used. Not "remember to consider the costs". The net cost is bad for everyone, that's why I said "evil".
    - 1GZ0 1y ago
      > It's completely fair game to react to the provocation rather than the substance of the article itself. Yeah, but its down right stupid to do so. The title isn't even misleading or part of a Motte-and-bailey argument. People just hear "Package Managers are Evil" and assume that the author means you shouldn't use third party dependencies. Which is NOT what's being argued. But I guess you'd know that, if you read passed the title.
      - papichulo2023 1y ago
        Sorry but I lack any respect for authors that use clickbaits. Call them put and move on seem the best approach.
        1GZ0 1y ago
        Its not clickbait though. You should try reading the article before passing judgement. Its not like the article is called "5 facts that will make you hate package managers. Number 5 will shock you"
        ModernMech 1y ago
        It was clickbait because the article, which I did read, did not support the contention that package managers are evil. Therefore "evil" seems to be used in a hyperbolic way to grab attention, which makes it clickbait, specifically ragebait.
        wannadingo 1y ago
        Then again, there is a trope going back to Knuth - "Premature optimization is the root of all evil" - which is an argument that it is not clickbait, but merely applying a pattern in discussions about computer programming.
        Defletter 1y ago
        Hyperbole is just a pretty common thing for humans to do
    - cxr 1y ago
      > The title is provocative and attention grabbing. -- It's completely fair game to react to the provocation rather than the substance No it isn't.
  - procaryote 1y ago
    I guess clickbait is evil
SideburnsOfDoom 1y ago
> He's arguing for developers to be more conscious of the dependencies they use "be careful all the time" doesn't scale. Half of all developers have below-average diligence, and that's a low bar. No-one is always vigilant, don't think that you're immune to human error. No, you need tooling, automation to assist. It needs to be supported at the package manager side. Managing a site where many files are uploaded, and then downloaded many times is not a trivial undertaking. It comes with oversight responsibilities. If it's video you have to check for CSAM. If it's executable code, then you have to check for malware. Package managers are not evil, but they are a tempting target and need to be secured. This can't just be an individual consumer responsibility. I can't speak for other ecosystems, but some NuGet measures are here: https://devblogs.microsoft.com/dotnet/building-a-safer-future-how-nuget-is-tackling-software-supply-chain-threats/ https://devblogs.microsoft.com/dotnet/building-a-safer-futur... https://learn.microsoft.com/en-us/nuget/concepts/security-best-practices https://learn.microsoft.com/en-us/nuget/concepts/security-be... I believe that there have been (a few) successful compromises of packages in NuGet, and that these have been mitigated. I don't know how intense the arms race is now.
- pjc50 1y ago
  > "be careful all the time" doesn't scale Yes, this is the C attitude, where you provide no safety rails or poka-yokes or, indeed, package managers, and therefore you get a lot of fragile reimplementations of package managers (autoconf, anyone?). But you get to keep the satisfaction of blaming the users. nuget is pretty good. It helps that packages tend to be substantial things, not left-pad.
  - SideburnsOfDoom 1y ago
    > It helps that packages tend to be substantial things, not left-pad. Agree, this is IMHO also a better pattern. 1-liners or even 20-liners are not worth the overhead of extracting a package. Or of depending on a package.
  - 1718627440 1y ago
    > autoconf, anyone? GNU Autoconf isn't a package manager, it's more an analogue to a setup executable on MS Windows, to detect where the user wants stuff to be installed, where the user has stuff already installed and which features the user wants.
ozim 1y ago
I disagree with this take. There should be just more governance on the registry side of things. For NuGet or Maven I think dependency hell is not something you run into and I don’t have package manager manager for those languages. There should be enough trust just like I can do sudo apt install. His take screams „I want to push my niche approach and promote my language from my Ivory Tower of language creator”. He still might not have any relevant experience building businesses line software just like O don’t have experience with building compilers or languages.

by 1GZ0 1y ago

pipes 1y ago

But titled the post "package managers are evil"

Defletter 1y ago
> The term “evil” is being used partially hyperbolic to make a point. Kind of bonkers this even needs to be said, and even then it's missed/ignored.
- rgoulter 1y ago
  The title is provocative and attention grabbing. -- It's completely fair game to react to the provocation rather than the substance of the article itself. (Or, rather, it's silly to use attention grabbing rhetoric, then complain that people paid attention to the rhetoric). I'd prefer instead a more balanced title like "Remember to Consider the Costs When Using Package Managers", or whatever.
  - gingerBill 1y ago
    The title of the article comes from the direct words I said in the video, of which the article is effectively a polished transcription of. Your "more balanced title" isn't even close to what I am saying. I am saying that Package Managers are just bad and should not be used. Not "remember to consider the costs". The net cost is bad for everyone, that's why I said "evil".
  - 1GZ0 1y ago
    > It's completely fair game to react to the provocation rather than the substance of the article itself. Yeah, but its down right stupid to do so. The title isn't even misleading or part of a Motte-and-bailey argument. People just hear "Package Managers are Evil" and assume that the author means you shouldn't use third party dependencies. Which is NOT what's being argued. But I guess you'd know that, if you read passed the title.
    - papichulo2023 1y ago
      Sorry but I lack any respect for authors that use clickbaits. Call them put and move on seem the best approach.
      - 1GZ0 1y ago
        Its not clickbait though. You should try reading the article before passing judgement. Its not like the article is called "5 facts that will make you hate package managers. Number 5 will shock you"
        ModernMech 1y ago
        It was clickbait because the article, which I did read, did not support the contention that package managers are evil. Therefore "evil" seems to be used in a hyperbolic way to grab attention, which makes it clickbait, specifically ragebait.
        wannadingo 1y ago
        Then again, there is a trope going back to Knuth - "Premature optimization is the root of all evil" - which is an argument that it is not clickbait, but merely applying a pattern in discussions about computer programming.
        Defletter 1y ago
        Hyperbole is just a pretty common thing for humans to do
  - cxr 1y ago
    > The title is provocative and attention grabbing. -- It's completely fair game to react to the provocation rather than the substance No it isn't.
- procaryote 1y ago
  I guess clickbait is evil

SideburnsOfDoom 1y ago

> He's arguing for developers to be more conscious of the dependencies they use "be careful all the time" doesn't scale. Half of all developers have below-average diligence, and that's a low bar. No-one is always vigilant, don't think that you're immune to human error. No, you need tooling, automation to assist. It needs to be supported at the package manager side. Managing a site where many files are uploaded, and then downloaded many times is not a trivial undertaking. It comes with oversight responsibilities. If it's video you have to check for CSAM. If it's executable code, then you have to check for malware. Package managers are not evil, but they are a tempting target and need to be secured. This can't just be an individual consumer responsibility. I can't speak for other ecosystems, but some NuGet measures are here: https://devblogs.microsoft.com/dotnet/building-a-safer-future-how-nuget-is-tackling-software-supply-chain-threats/ https://devblogs.microsoft.com/dotnet/building-a-safer-futur... https://learn.microsoft.com/en-us/nuget/concepts/security-best-practices https://learn.microsoft.com/en-us/nuget/concepts/security-be... I believe that there have been (a few) successful compromises of packages in NuGet, and that these have been mitigated. I don't know how intense the arms race is now.

pjc50 1y ago
> "be careful all the time" doesn't scale Yes, this is the C attitude, where you provide no safety rails or poka-yokes or, indeed, package managers, and therefore you get a lot of fragile reimplementations of package managers (autoconf, anyone?). But you get to keep the satisfaction of blaming the users. nuget is pretty good. It helps that packages tend to be substantial things, not left-pad.
- SideburnsOfDoom 1y ago
  > It helps that packages tend to be substantial things, not left-pad. Agree, this is IMHO also a better pattern. 1-liners or even 20-liners are not worth the overhead of extracting a package. Or of depending on a package.
- 1718627440 1y ago
  > autoconf, anyone? GNU Autoconf isn't a package manager, it's more an analogue to a setup executable on MS Windows, to detect where the user wants stuff to be installed, where the user has stuff already installed and which features the user wants.

ozim 1y ago

I disagree with this take. There should be just more governance on the registry side of things. For NuGet or Maven I think dependency hell is not something you run into and I don’t have package manager manager for those languages. There should be enough trust just like I can do sudo apt install. His take screams „I want to push my niche approach and promote my language from my Ivory Tower of language creator”. He still might not have any relevant experience building businesses line software just like O don’t have experience with building compilers or languages.