News for hackers. Stuff that matters.

A comment on Ask HN: Why did Frontend development explode in complexity?. Parent comment

Re:Ask HN: Why did Frontend development explode in complexity? by Joeri on Monday January 02, 2023 @12:48PM (#34221023)
For me the reason for the explosion in complexity in both frontend and backend comes down to package managers on all platforms getting way better with transitive dependencies and lowering the cost of adding those dependencies. Developers used to be wary of bringing in another dependency just in case it created some conflict, but ecosystems that near-perfectly encapsulate transitive dependencies have gradually done away with that healthy wariness, with a combinatorial explosion in packages as a consequence.

Create-react-app installs 1500 packages to show a hello world page, and it is quite sane in its choice of dependencies. For me this is a symptom of the whole npm ecosystem being diseased with dependicitis.

[ Parent | on HN ]
Re:Ask HN: Why did Frontend development explode in complexity? by erlich on Tuesday January 03, 2023 @05:18AM (#34229828)
Ironically, I think more dependencies are actually better, because it means they are smaller. "Do one thing well".

The problem is large dependencies depending on other large dependencies.

Dependencies should advertise their transitive dependency tree size including LOC per dep.

Also, the fact that every dep has it's own non-standard build process, language, dir structure, and ESM/CJS legacy support, makes things not ideal.

[ Parent | on HN ]
Re:Ask HN: Why did Frontend development explode in complexity? by lolinder on Tuesday January 03, 2023 @09:16PM (#34241101)
> Ironically, I think more dependencies are actually better, because it means they are smaller. "Do one thing well".

I could believe this if I thought that having 1500 dependencies led to less code overall, but the size of my node_modules folder shows that assumption to be flawed.

The other problem with this argument is that each dependency you add is another set of developers that you are depending on. It's another group of people who could suddenly pull a left pad or worse, and it's another group of people who you have to trust to have written secure code. The fewer dependencies I have, the smaller my chances of being exploited because of a people problem.

[ Parent | on HN ]