321–325 of 325 posts
Earlier quoted context omitted.
Which better ways are you referring to?
Install from GitHub directly is probably the simplest.
Installing from GH directly can also fall apart when fancy built scripts are in place that have to be ran to create actual useful code. :(
When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…
Searching for the string "down_load_ebook" does unearth a lot of packages. https://www.npmjs.com/search?q=down_load_ebook About 100k spam packages, with no false positives that I can see.
Earlier quoted context omitted.
Yup for sure, 100%. Pulling in a library every time you don't know how to do something is a choice. Only pulling in dependencies that have 10,000 Github stars or are in every react Youtube video without evaluating alternatives is also a choice. I learned to be way more discriminating about npm libraries from a tech lead a few years ago, and to be honest it's one of the best lessons I've learned in a while.
But it is not a viable choice anymore to “not include this useful dependency, because its dependency tree is huge, so I will just rewrite it from scratch”, which is what practically happens in most cases. No one deliberately imports bullshit like leftpad on the root level. If you use react alone it will probably already make enough of a mess that windows’s file operations will take considerable time on your node_modu…
We're saying "think about each dependency you're considering pulling in. Maybe have a quick browse through the code. Is it a gigantic hot mess? Is it tiny and elegant? Does it only have 3 downloads/week on npm? There are lots of things you can do before deciding to rewrite it yourself, but yes, I argue there are definitely some dependencies where that is the right call. But also, YMMV - it depends on your team and resources too.
Earlier quoted context omitted.
No he means “being poor isn’t an excuse for being asshole”. Just like keying your neighbor car because he could afford nice one is not acceptable whatever you feel like.
"Keying your neighbors car because they have a nicer one" is not an analogy that works for anything here. What is happening in NPM is not a car being keyed. There is a profit motive for doing this. Perhaps you could say "Stealing 1 gallon of gas from your rich neighbors car to feed your starving children makes you an asshole", that's an analogy that seems to fit what is happening here, and an opinion I would disagree…
IF you steal gas from neighbors car to feed starving children does not make you an asshole.
If you do it in a way to minimize damage.
If you come over and mess his whole car up in the process just because "he is rich" - that makes one an asshole.
The same with spamming NPM, OK I can understand they feel the need to earn money - but they are messing up something useful for others in bad way. They probably could still put effort to do many other things that would bring profit and would not mess up thing that many people will start loosing trust.