Ask HN: Why does every package+module system become a Rube Goldberg machine?

Re:Ask HN: Why does every package+module system become a Rub... by omgtehlion on Monday January 30, 2023 @06:11AM (#34578288)

I think, this is not a problem with package manager per se. But with extremities of coding culture. On one side of the spectrum is “NIH” and reinvent everything yourself. On the other side is: let’s pull left-pad from package, because packages are good, we need MORE PACKAGES.

The best solution always lies somewhere in the middle. But finding this “middle” (and adhering to this approach) is the hard part.

[ Parent | on HN ]

Re:Ask HN: Why does every package+module system become a Rub... by marcus_holmes on Monday January 30, 2023 @12:07PM (#34582830)

I think I'm on the NIH side of things. Not because I like inventing things (well, partially), but because of the security problem [0].

I don't see it being talked about here, either. Our current system of pulling in packages made by random people on the internet is going to burn us. We assume that everyone who creates a package is an honest, reliable, developer who will not inject malicious code into their package. This assumption is similar to the assumptions we made around SMTP, HTTP, DNS, and every other internet protocol. Turns out we were wrong and surprise! you can't trust people on the internet.

I'm not sure if we can solve this with package managers. But package managers are part of the culture that has created this problem, and are probably a reasonable starting point to try and address it.

[0]:https://david-gilbertson.medium.com/im-harvesting-credit-car...

[ Parent | on HN ]