News for hackers. Stuff that matters.
Re:Node.js packages don't deserve trust by dgb23 on Monday April 11, 2022 @10:40AM (#30989427)
Can we determine whether the package/LoC ratio actually has the quality impact that people think it has? Or dependencies/project?

Because I don't think those are useful metrics at all. In fact this is just code re-use and should probably be happening to a significant degree.

Some actually interesting properties are:

- basic performance

- signal to noise ratio

- API stability

- robustness

- clarity and simplicity...

And more of that. But just saying "a lot of dependencies bad" is not useful.

Maybe in an ideal world we have even _more_ dependencies? I don't know. What I do know is that I care about the above points much more.

Re:Node.js packages don't deserve trust by vlunkr on Monday April 11, 2022 @02:54PM (#30993064)
> And more of that. But just saying "a lot of dependencies bad" is not useful.

I disagree. The primary problem is that proper dependency auditing is incredibly time-consuming, especially if you want to stay up-to-date. The reality is that most people simply don't do it all.