Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fate of "small" open source

nolanlawson.com

Post reply on HN
Print view View original

111–120 of 238 posts

Re: The fate of "small" open source

#111

Post by llbbdd »

KPGv2 wrote: post #90
sodapopcan wrote: post #54

Earlier quoted context omitted.

Usually these types if things never change. I understand that all code is a liability, but npm takes this way too far. Many utility functions can be left untouched for many years if not forever.

It's not NPM. It's JS culture. I've done a lot of time programming in TypeScript, and it never fails that in JS programmer circles they are constantly talking about updating all their packages, completely befuddled why I'd be using some multiple year old version of a library in production, etc. Meanwhile Java goes the other way: twenty-year old packages that are serious blockers to improved readability. Running Java…

Java writes to a bytecode spec that has failed to keep up with reality, to its detriment. Web development keeps up with an evolving spec pushed forward by compatibility with what users are actually using. This is "culture" only in the most distant, useless sense of the word. It is instead context, which welcomes it back into the world of just fucking developing software, no matter how grey-haired HN gets with rage while the world moves on.

EDIT: Obvious from the rest of your responses in this thread that this is trolling, leaving this up for posterity only

Re: The fate of "small" open source

#112

Post by cortesoft »

mkj wrote: post #82
bloomca wrote: post #60

Earlier quoted context omitted.

But in a lot of cases you can't know all the dependencies, so you lean on the community trusting that a package solves the problem well enough that you can abstract it. You can pin the dependency and review the changes for security reasons, but fully grasping the logic is non-trivial. Smaller dependencies are fine to copy at first, but at some point the codebase becomes too big, so you abstract it and at that point i…

You'd get those benefits from traditional dependencies if you copy them in and never update. Is an AI dependency going to have the equivalent of "upstream fixes"?

Probably? LLMs will train on fixes, then if you run the code through the LLM again to fix it.

Re: The fate of "small" open source

#113

Post by llbbdd »

KPGv2 wrote: post #87
SchemaLoad wrote: post #81

Earlier quoted context omitted.

Most of these util libraries require basically no changes ever. The problem is the package maintainers getting hacked and malicious versions getting pushed out.

If you use an LLM to generate a function, it will never be updated. So why not do the same thing with a dependency? Install it once and never update it (and therefore hacked and malicious versions can never arrive in your dependency tree). You're a JS developer, right? That's the group who thinks a programmer's job includes constantly updating dependencies to the latest version constantly.

You're not a web developer, right? See my other comment about context if you want to learn more about the role of context in software development in general. If you keep repeating whatever point you're trying to make about some imaginary driving force to pointlessly update dependencies in web dev, you'll probably continue to embarrass yourself, but it's not hard to understand if you read about it instead of repeating the same drivel under every comment in this thread.

Re: The fate of "small" open source

#114

Post by eviks »

I suppose some people would see this as progress: fewer dependencies, more robust code (even if it’s a bit more verbose), quicker turnaround time than the old “search npm, find a package, read the docs, install it” approach.

Why would randomized code be more robust? Also, how is searching/reading the docs slower than checking the correctness of a randomized function?

Re: The fate of "small" open source

#115

Post by llbbdd »

nineteen999 wrote: post #107
KPGv2 wrote: post #87

Earlier quoted context omitted.

If you use an LLM to generate a function, it will never be updated. So why not do the same thing with a dependency? Install it once and never update it (and therefore hacked and malicious versions can never arrive in your dependency tree). You're a JS developer, right? That's the group who thinks a programmer's job includes constantly updating dependencies to the latest version constantly.

> Install it once and never update it (and therefore hacked and malicious versions can never arrive in your dependency tree). Huh? What if your once-off installation or vendoring IS a hacked an malicious version and you never realise and never update it. That's worse.

Hardly worth responding to, from other comments they're defending Java. They're not used to updates.

Re: The fate of "small" open source

#116

Post by eviks »

Levitating wrote: post #68

I am sure I am not the only one who thinks these micro-dependencies are worthless anyway. You'd be better off just listing the functions in a markdown file for people to copy over than ship an entire package for it. This isn't "small" open source, "small" would be something you put together in a week or weekend. These are like "micro" projects, where more work goes into actually publishing and maintaining the reposit…

What's your copy& paste solution to security updates?

Re: The fate of "small" open source

#117

Post by llbbdd »

weitendorf wrote: post #62
RyanHamilton wrote: post #2

Less incentive to write small libraries. Less incentive to write small tutorials on your own website. Unless you are a hacker or a spammer where your incentives have probably increased. We are entering the era of cheap spam of everything with little incentive for quality. All this for the best case outcome of most people being made unemployed and rolling the dice on society reorganising to that reality.

[flagged]

Upvoting because it's a salient point and downvoters are mad. HN has a complex lately.

Re: The fate of "small" open source

#118

Post by llbbdd »

Levitating wrote: post #68

I am sure I am not the only one who thinks these micro-dependencies are worthless anyway. You'd be better off just listing the functions in a markdown file for people to copy over than ship an entire package for it. This isn't "small" open source, "small" would be something you put together in a week or weekend. These are like "micro" projects, where more work goes into actually publishing and maintaining the reposit…

Why aren't those tiny header file libraries just part of the standard C library?

Wait sorry, I don't mean that. I read too many bog-standard HN comments about NPM above.

Re: The fate of "small" open source

#119

Post by llbbdd »

ef2k wrote: post #92

> I’m still trying to figure out what kinds of open source are worth writing in this new era Is there any upside to opensourcing anything anymore? Anything published today becomes training data for the next model, with no attribution to the original work. If the goal is to experiment, share ideas, or let others learn from the work, maybe the better default now is "source available", instead of FOSS in the classic sen…

I keep seeing this attitude and I don't really understand it at all; there's no upside to publishing open source work because it might be utilized by more people, is that correct?

Or is it the attribution? There are many many libraries I have used and continue to use and I don't know the author's internet handle or Christian name. Does that matter? Why?

I have written a lot of code that my name is no longer attached to. I don't care and I don't know why anyone does. If it were valuable I would have made more money off of it in the first place, and I don't have the ego to just care that people know it's my code either.

I want the things I do today to have an upside for people in the future. If that means I write code that gets incorporated into a model that people use to build things N number of years from now, that's great. That's awesome. Why the hell is that apparently so demotivating to some people?

Re: The fate of "small" open source

#120

Post by llbbdd »

1gn15 wrote: post #106
ef2k wrote: post #92

> I’m still trying to figure out what kinds of open source are worth writing in this new era Is there any upside to opensourcing anything anymore? Anything published today becomes training data for the next model, with no attribution to the original work. If the goal is to experiment, share ideas, or let others learn from the work, maybe the better default now is "source available", instead of FOSS in the classic sen…

Staying true to free software principles. It's unethical to publish nonfree code or binaries.

Code is only useful if it's used. I could write a ton of code and be buried with it, or publish it for people (or AI software, or dolphins or aliens) to use. Who has the energy to have Anubis measure whether my code, or yours, is ethical enough? I'm going to die someday!
Post reply on HN