Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pika: Making it easier to find, publish, install, and use modern packages on npm

pikapkg.com

Post reply on HN
Print view View original

1–10 of 60 posts

Re: Pika: Making it easier to find, publish, install, and use modern packages on npm

#2

Post by saagarjha »

From the news I hear (which is quite slanted, I will admit, since I write very little JavaScript) the issue with npm is that it's too easy to publish things on npm and use them, which leads to a dependency mess and breakage when things are removed or get hacked. Is this something that the JavaScript community needs?

Re: Pika: Making it easier to find, publish, install, and use modern packages on npm

#3

Post by bayesian_horse »

saagarjha wrote: post #2

From the news I hear (which is quite slanted, I will admit, since I write very little JavaScript) the issue with npm is that it's too easy to publish things on npm and use them, which leads to a dependency mess and breakage when things are removed or get hacked. Is this something that the JavaScript community needs?

Compared to PyPi it looks like npm packages are much more granular. You'd see the functionality of a popular Python package spread out into multiple npm packages.

Both approaches have their advantages. I'd say that for security and reliability, you really need to know what packages you are running. Often you can delegate the responsibility to bigger upstream projects/groups.

For example if Facebook works with and on React, you can put a good lower bound on the reliability/security of React and the packages it pulls in. I'd be a lot more suspicious of packages which are rarely used by significant other projects.

Re: Pika: Making it easier to find, publish, install, and use modern packages on npm

#4

Post by jondubois »

saagarjha wrote: post #2

From the news I hear (which is quite slanted, I will admit, since I write very little JavaScript) the issue with npm is that it's too easy to publish things on npm and use them, which leads to a dependency mess and breakage when things are removed or get hacked. Is this something that the JavaScript community needs?

I don't think that npm itself should be blamed for being too easy to use - That's a good thing in most cases. I think that the main problem is that a couple of years ago some very vocal members of the Node.js community had been promoting a hard-line philosophy around publishing and using tiny modules.

The consequence of that is that projects ended up with hundreds of tiny dependencies (and sub-dependencies) which increased the attack surface and introduced their own bugs and/or vulnerabilities.

I think that the Node.js community is wiser now. Vulnerability detection tools like Snyk.io have been useful in encouraging module authors to remove unnecessary dependencies from their modules.

Now the trend seems to be to use a fewer modules which offer more functionality that is more closely matched to the use case.

Re: Pika: Making it easier to find, publish, install, and use modern packages on npm

#5

Post by futureastronaut »

saagarjha wrote: post #2

From the news I hear (which is quite slanted, I will admit, since I write very little JavaScript) the issue with npm is that it's too easy to publish things on npm and use them, which leads to a dependency mess and breakage when things are removed or get hacked. Is this something that the JavaScript community needs?

I don't know, did you try clicking the link after replying to the title? Or is it time for another generic top-comment thread about npm?

Re: Pika: Making it easier to find, publish, install, and use modern packages on npm

#6

Post by saagarjha »

futureastronaut wrote: post #5
saagarjha wrote: post #2

From the news I hear (which is quite slanted, I will admit, since I write very little JavaScript) the issue with npm is that it's too easy to publish things on npm and use them, which leads to a dependency mess and breakage when things are removed or get hacked. Is this something that the JavaScript community needs?

I don't know, did you try clicking the link after replying to the title? Or is it time for another generic top-comment thread about npm?

I did, but I'm not really sure I know what this. Is looks like it's performing filtering for "ES modules" on npm?

Re: Pika: Making it easier to find, publish, install, and use modern packages on npm

#9

Post by hliyan »

While I'm a big fan of native modules, I find the constant use of the adjective "modern" in new JS project descriptions somewhat disturbing. Being modern in itself is not of any value. If it loads faster, or if it obviates the need for a bundler, or if it makes granular upgrades easier, or if it reduces the amount of configurations or tooling, we should put those benefits first.
Post reply on HN