Re:It’s OK for your open source library to be a bit shitty (...
by Vinnl on Sunday May 17, 2020 @04:57AM
(#23210671)
> Why even let people publish packages if they're not meant to?
I don't think GP even so much as insinuated in their post that people aren't meant to publish packages in general.
Re:It’s OK for your open source library to be a bit shitty (...
by matheusmoreira on Sunday May 17, 2020 @08:14PM
(#23216792)
The argument was: only packages which are good enough for production use ought to be published on official package repositories. This allows people to assume that all packages on the repository are stable, well maintained, good quality software without manually verifying each dependency.
So why even let random people sign up a developer account and publish packages? Maybe they need a separate curated "serious packages only" repository.
Re:It’s OK for your open source library to be a bit shitty (...
by ex_amazon_sde on Sunday May 17, 2020 @06:54AM
(#23211118)
> Being able to publish an open source project without dealing with Linux distribution maintainers is a major selling point of programming language package managers.
This is how disasters like leftpad happen.
The bar for publishing software is extremely low and we pay the price every day in terms of security, bloat and complexity.
Re:It’s OK for your open source library to be a bit shitty (...
by watwut on Sunday May 17, 2020 @12:40PM
(#23213146)
Left pad disaster happened because 1.) npm took away another authors project 2.) npm makes it overly easy to unpublish already published projects. That is ridiculous.
It has nothing to do with how easy it is to publish things. Also, adding own left-pad once disaster happened is quite easy in node.js modules system.
Package repositories can be open to all developers or curated by software distribution maintainers. Being able to publish an open source project without dealing with Linux distribution maintainers is a major selling point of programming language package managers.
Why even let people publish packages if they're not meant to?
> it is totally their fault for deploying something without carefully reading your code to figure out that it was a bit shitty beforehand... but should they really have to do that?
Absolutely. Using someone else's code means implicitly trusting them. Everyone should at least check out the package's source code for quality, sanity and signs of maintenance.