Re:The State of JavaScript 2018
by rafaelvasco on Monday November 19, 2018 @09:18AM
(#18486524)
Not exactly Yarn or NPM. The problem is that JS is suffering from extreme dependency hell, due to overly fragmentation of modules. It's appalling. It is not a good thing starting a project, doing a install and having hundreds and hundreds of modules on node_modules, some with less then 50 lines of code. Of course things must be modular, but unwraping everything in a folder like this is far from good.
[ Parent
| on HN ]
Isn't the issue here basically that JS doesn't have a "standard" authorized library, like Java or C# and NPM has basically become the standard library?
Having someone like Google steward a "standard" library (and it could even be distributed using NPM), would pretty much bring JS dependency management at par and beyond Java or C#.
hmm maybe you're onto something here..
I'm curious: why is it bad? I very, very rarely have to delve into my node_modules folder to take a look at something.
You should take a proper look once, you'll be amazed at all the different modules implementing the same functionality over and over again (e.g. globbing, promisifying, or the myriad of `is-*` single-function packages).
Why is that bad? It's a huge waste of effort, increases the burden on anyone who's maintaining a package using those micro-libraries, and will guarantee more unpatched security vulnerabilities and unmaintained packages in the long run.
The leftpad fiasco (which I believe NPM has now mitigated), and the recent security issue where a certain popular package was uploading any passwords it found showed the current dangers with NPM.
Re:The State of JavaScript 2018
by erik_seaberg on Monday November 19, 2018 @04:27PM
(#18489894)
The lesson from left-pad should have been to vendor all your deps rather than bet your org on third parties with no SLA commitment to you.
I'm not arguing about the security of NPM, rather the idea that multiple modules is a bad thing.