News for hackers. Stuff that matters.
Re:Rewriting Sysctl(8) in Rust: Systeroid by jrockway on Tuesday April 19, 2022 @01:33PM (#31086188)
I mean, the number of dependencies a node project uses doesn't really affect me. If they have 1 or if they have 1 million, it's the same "npm install" command.

I personally like to keep third-party dependencies as minimal as possible, mostly to avoid getting 8 emails a day from dependabot telling me that a dependency of a dependency of a dependency has a regex denial of service attack and some dependency in the middle has a massive breaking change that prevents another dependency from being upgraded to include the fix. (Nevermind that I'm using it on the frontend, so if a user picks a bad regex they will slow down their own browser and nobody else's.)

Re:Rewriting Sysctl(8) in Rust: Systeroid by gspr on Wednesday April 20, 2022 @03:33AM (#31093860)
> If they have 1 or if they have 1 million, it's the same "npm install" command.

Only if you accept one single, unflexible way of installing the software.