Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A critique of package managers

gingerbill.org

Post reply on HN
Print view View original

181–190 of 220 posts

Re: A critique of package managers

#181

Post by j2kun »

forrestthewoods wrote: post #138
izzylan wrote: post #119

I don't see the value in making it even harder to build software. I want to make things. Downloading a dependency manually and then cursing at the compiler because "it's right there! why won't it load!!" is just gonna make me want to build software less. Anyone I want to work with on a project is going to have to have the same frustration and want to work on the project less. Only even more because you see they downl…

This is an argument for a good build system, not a package manager.

Build systems are yet another special circle of hell.

Re: A critique of package managers

#182

Post by j2kun »

Malix_off wrote: post #173

> People abuse cars and ram into crowds, so let's not have cars in our city! > People abuse knives and stab people, so let's not have knives in our kitchen! > People abuse package managers and create dependency hells, so let's not have package managers in our programming language! No matter how you see it, this fits the definition of dumbing down; Is this what you really want? If that is the case, then we can shake h…

If you've ever lived in a place with a localized car ban, it's awesome.

Re: A critique of package managers

#183

Post by ModernMech »

1GZ0 wrote: post #170
papichulo2023 wrote: post #160

Earlier quoted context omitted.

Sorry but I lack any respect for authors that use clickbaits. Call them put and move on seem the best approach.

Its not clickbait though. You should try reading the article before passing judgement. Its not like the article is called "5 facts that will make you hate package managers. Number 5 will shock you"

It was clickbait because the article, which I did read, did not support the contention that package managers are evil. Therefore "evil" seems to be used in a hyperbolic way to grab attention, which makes it clickbait, specifically ragebait.

Re: A critique of package managers

#184

Post by ModernMech »

bigstrat2003 wrote: post #129
jitl wrote: post #49

Earlier quoted context omitted.

Rust’s big issue here is the anemic standard library. I think overall the strategy makes some amount of sense; since there’s so much crazy alchemy like depending on nightly, no_std, etc in Rust, including stuff in std has more downside in Rust than in a language that’s more stable like Go. But it’s annoying to have to deal with 3 different time libraries and 3 different error creation libraries and 2 regex libraries…

The very sparse std is one of the few genuine mistakes I think Rust has made. I know the arguments for it, but I don't find them persuasive. A batteries included standard library, in my view, is just plain better and every modern language should have one.

But what batteries to include? I'm sure your list of batteries is probably very different from mine, reflecting the difference in the work we both do. A lot of times when I hear a language has "batteries included", it's a bunch of features for web devs and nothing I would consider a "battery" for my projects.

Re: A critique of package managers

#185

Post by SideburnsOfDoom »

ozim wrote: post #163
SideburnsOfDoom wrote: post #27

Earlier quoted context omitted.

> He's arguing for developers to be more conscious of the dependencies they use "be careful all the time" doesn't scale. Half of all developers have below-average diligence, and that's a low bar. No-one is always vigilant, don't think that you're immune to human error. No, you need tooling, automation to assist. It needs to be supported at the package manager side. Managing a site where many files are uploaded, and t…

That's not package manager problem that's registry problem. NuGet is not having as many problems as NPM but also NPM is much more popular. NPM is also quite a wild west when it comes to publishing packages, any kid can make an account and publish 'left-pad' kind of crap. We already have quite safe and working setup with APT and software repositories for Debian, Ubuntu etc. While it is not so easy to publish your soft…

> That's not package manager problem that's registry problem

I do not think that the two are cleanly separable. They are client and server ends of the same system.

And I think my point is that I view it as more of a server (registry) and governance problem than the OP author does.

Despite the fact that my employer also has an internal package feed, the security of nuget.org and the central public feed is intrinsic to the security of the whole system.

Nuget was closer to the NPM end of the spectrum, but has tightened up considerably over time. Particularly the "Package ID Prefix Reservations" feature tells me that package names that start with certain words are owned by the relevant entity, be it "System." or "Azure." from Microsoft, or "AWS" from Amazon.

This is important as it's used to distribute SDKs and optional but standard library components and updates.

There is certainly junk on there, but not much load-bearing junk.

Re: A critique of package managers

#186

Post by gingerBill »

ModernMech wrote: post #184
bigstrat2003 wrote: post #129

Earlier quoted context omitted.

The very sparse std is one of the few genuine mistakes I think Rust has made. I know the arguments for it, but I don't find them persuasive. A batteries included standard library, in my view, is just plain better and every modern language should have one.

But what batteries to include? I'm sure your list of batteries is probably very different from mine, reflecting the difference in the work we both do. A lot of times when I hear a language has "batteries included", it's a bunch of features for web devs and nothing I would consider a "battery" for my projects.

What do you consider your set of "Batteries Include"?

Re: A critique of package managers

#187

Post by saulpw »

1718627440 wrote: post #148
saulpw wrote: post #132

Earlier quoted context omitted.

I think the main thing that makes this workable is "The library is usually a small, flat collection of atomic functions." I find that it's the hell of transitive dependencies--you as a developer can reasonably vet a single layer of 10-30 standalone libraries. But if those libraries depend on other libraries, etc, then it balloons into hundreds or thousands of dependencies, and then you're sunk. For what it's worth, I…

In C and C++ you don't need the transitive dependencies for compilation, you only need the header of the direct dependencies. As for linking they are only needed when linking dynamically, which was much less prevalent 20 years ago.

It's not about compilation, it's about interactions, and leaky abstractions.

Re: A critique of package managers

#188

Post by ModernMech »

gingerBill wrote: post #186
ModernMech wrote: post #184

Earlier quoted context omitted.

But what batteries to include? I'm sure your list of batteries is probably very different from mine, reflecting the difference in the work we both do. A lot of times when I hear a language has "batteries included", it's a bunch of features for web devs and nothing I would consider a "battery" for my projects.

What do you consider your set of "Batteries Include"?

Basically the stuff in here: https://www.ros.org

Re: A critique of package managers

#189

Post by tialaramex »

dismalaf wrote: post #168
lifthrasiir wrote: post #153

Earlier quoted context omitted.

If that's what happens, I think in the following claim: > Odin's compiler knows what a package is and will compile it into your program automatically. ...the word "automatically" should be dropped. Of course compilers compile any supplied dependency "automatically", but it is so obvious that we don't often use the adverb just for that.

> Of course compilers compile any supplied dependency "automatically", but it is so obvious that we don't often use the adverb just for that. They often don't though. Rust, C, C++ need either long command line invocations or a build system for anything beyond hello world. Zig needs a build file for anything beyond hello world. With Odin, you just invoke "odin build ." and all your dependencies are taken in without ne…

This seems like a loss of separation of concerns. As a result Odin's compiler is full of completely unrelated stuff because it takes on this far larger role supervising everything about a project not just being a compiler.

Both Zig and Rust supply all of what you needed in the box, so all that Odin is doing here is commingling these features inside a single executable - there's no end user benefit that I can see.

Re: A critique of package managers

#190

Post by forrestthewoods »

justinrubek wrote: post #172
01HNNWZ0MV43FF wrote: post #161

Earlier quoted context omitted.

True. The most popular Unix is after all macOS, followed shortly by WSL2

There are way more servers running linux than there are macos installs. And wsl2 is linux.

Number of servers isn’t the right metric imho.

Literally all code I write runs on Windows, macOS, Android, and Linux. In roughly that order of priority. No I do not and will not use WSL2, it’s an abomination.

Post reply on HN