If I want to work with JSON, I use Newtonsoft.JSON. If I want an ORM I'll use Dapper (lightweight) or Entity Framework. So many libraries that would you need if you're using Java or JS is just built in to the standard library.
I know it's not a 100% fair comparison, since I am biased. Part of it also might be because .NET is younger and less widely used, but I feel it's pretty true. Though, Python has ton of open source support and is better in this regard.
It might also have something to do with you apparently unironically comparing a framework to a programming language.
What Microsoft chooses to call the .NET Standard Libraries is not at all the same thing as a language's standard library.
> NuGet is the package manager for .NET.
So my point is invalid because I wrote .NET instead of C#/VB/F#? You might want to contact nuget to tell them their site is wrong too then.
My point is that finding quality packages is easier with nuget than the JS or Java package managers. And using them is usually easier too. It's a fair comparison.
C# is, VB.NET is, F# is. .NET, not as much.
This is a feature.
- They can't currate packages, or else that friction will drastically slow down the ecosystem (1000's of packages get published everyday).
- They can't remove/disable packages (most of the time), or dependencies will no longer be strictly immutable.
- They can't disable sub-dependencies, or else this would greatly reduce code reuse and increase redundancy and complexity of packages (every package may have to roll there own X, or compile their package dependencies into bundled JS with no dependencies).
I think the problem is simply; it's a low friction dependency management solution -> which made it so popular -> which is making it a target for malicious actors.