Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A critique of package managers

gingerbill.org

Post reply on HN
Print view View original

211–220 of 220 posts

Re: A critique of package managers

#211

Post by ModernMech »

gingerBill wrote: post #206
ModernMech wrote: post #183

Earlier quoted context omitted.

It was clickbait because the article, which I did read, did not support the contention that package managers are evil . Therefore "evil" seems to be used in a hyperbolic way to grab attention, which makes it clickbait, specifically ragebait.

I wouldn't class it as clickbait myself, but I will stand by the use of the word "evil". I am using evil in the very old fashioned sense: the privation of the good. Is the title provocative? Yes. But that's the point of the article in general. I am trying to argue that they are a net bad with virtually no good upsides to them for the programming world as a whole. They've automated something at scale which should not…

> I am trying to argue that they are a net bad with virtually no good upsides to them for the programming world as a whole.

What I'm saying is that you have failed in this argument. You hardly even attempt to make it. Thus clickbait.

You said "this is why I am saying it is evil, as it will send you to hell quicker."

Okay, so then it's up to you to prove this hell actually exists. But you don't. You just assert its existence -- "Dependency hell is a real thing which anyone who has worked on a large project has experienced." By framing it this way, you can dismiss anyone who claims to not have experienced this as not having sufficient experience. But reading the comments here, a lot of people have experienced a sort of "dependency hell" (the kind that's talked about in the wiki you link to) that is solved by package managers.

So that's why it's classed as clickbait -- you (admittedly) wrote a provocative headline that you don't even remotely back up.

FYI for the future since you're lamenting in many comments that people are misinterpreting you, this is why. Given that you don't really make an attempt to prove this dependency hell and package managers are evil, and you don't acknowledge anything good about them, it's reasonable to assume your bias is just that dependencies are evil at their core. It's actually the most charitable reading because otherwise you seem confused.

Re: A critique of package managers

#212

Post by Ygg2 »

gingerBill wrote: post #209
Ygg2 wrote: post #208

Earlier quoted context omitted.

I don't think it will matter. There will be things people want that Odin won't have in the vendor package list. Then those people will have to manage dependencies, which is a hell on its own. Which will cause problems. Because people are super lazy so they will automate it. In the end only thing no package manager gets you is multiple package managers to juggle. Many languages started without package managers and eve…

Again, I am not against third party packages, and manual management of dependencies just slows down your progression to hell. There is no "solution" to this problem, only trade-offs. I know people are lazy and will automate hell. That's the entire point of the article: not everything that can be automated ought to be automated. And the argument about multiple package managers to juggle is only the case IFF there are…

> I honestly doubt it would happen if we enforced what a package is in the language. I just don't want to officially endorse one ever because I do view them to be evil.

I don't see how changing package definition is going to help. JS had no concept of package and it was bolted on with NPM. If Odin becomes big enough, the community will override the will of the author.

Plus I don't see huge benefits to not having a package manager other than saving disk space.

Security isn't that much meaningfully better than NPM.

Trust problem exists regardless of package manager.

And people aren't far to trusting, but far too lazy. And importing packages gets job done quickly.

Re: A critique of package managers

#213

Post by etbebl »

> In real life, when you have a dependency, you are responsible for it. If the thing that is dependent on you does something wrong, like a child or business, you might end up in jail, as you are responsible for that.

Isn't this backwards? In real life, if you have a dependent, you are responsible for it. On the other hand, if you have a dependency on something, you rely on that thing, in other words it should be responsible for you. A package that is widely used in security-critical applications ought to be able to be held accountable if its failure causes harm due to downstream applications. But because that is in general impossible and most library authors would never take on the risk of making such guarantees, the risk of each dependency is taken on by the person who decides it is safe to use it, and I agree package managers sometimes make that too easy.

Re: A critique of package managers

#214

Post by cxr »

rgoulter wrote: post #39
Defletter wrote: post #25

Earlier quoted context omitted.

> The term “evil” is being used partially hyperbolic to make a point. Kind of bonkers this even needs to be said, and even then it's missed/ignored.

The title is provocative and attention grabbing. -- It's completely fair game to react to the provocation rather than the substance of the article itself. (Or, rather, it's silly to use attention grabbing rhetoric, then complain that people paid attention to the rhetoric). I'd prefer instead a more balanced title like "Remember to Consider the Costs When Using Package Managers", or whatever.

> The title is provocative and attention grabbing. -- It's completely fair game to react to the provocation rather than the substance

No it isn't.

Re: A critique of package managers

#215

Post by kunley »

tialaramex wrote: post #95
kunley wrote: post #87

Earlier quoted context omitted.

Why the need for distinguishing and an urge for comparison? We're talking about Odin, that's it. As a project that (as I understand) didn't have any big corp investment, it's impressive.

The claim was that we should assume Odin's author is experienced because he wrote a successful language. If we've decided it doesn't matter whether it's successful then the claim was entirely circular. Yes, the creator of Odin is indeed its creator. Nobody was disputing that.

Even if he was unsuccesful but tried long enough, that would still make him experienced.

I don't see how a detailed comparing of language successfullness would bring anything valuable to the point being made about the author being experienced. That seemed just a noise.

Re: A critique of package managers

#217

Post by gingerBill »

krapp wrote: post #126
mouse_ wrote: post #123

is sdl2 really that bad?

It's impossible to know what issues they have, since they don't specify. But no, for the vast majority of people, SDL2 is perfectly fine, although SDL3 is a vast improvement. It's as stable and battle-tested as a cross platform multimedia library is bound to get. Opening a window and polling input is trivial. Then again I've never even heard of the language they're using (Odin) so maybe that doesn't play well with a…

The bugs have nothing to do with the language and exist in C too.

I'll just link to some of the bugs directly that posted as issues to SDL:

https://github.com/libsdl-org/SDL/issues/4789 (not fixed) https://github.com/libsdl-org/SDL/issues/4816 (closed) https://github.com/libsdl-org/SDL/issues/4790 (closed)

And these being the bugs we found ourselves, not other bugs that have already been found, and many marked "as not planned" since SDL2 is now finished.

Re: A critique of package managers

#218

Post by dismalaf »

Ygg2 wrote: post #212
gingerBill wrote: post #209

Earlier quoted context omitted.

Again, I am not against third party packages, and manual management of dependencies just slows down your progression to hell. There is no "solution" to this problem, only trade-offs. I know people are lazy and will automate hell. That's the entire point of the article: not everything that can be automated ought to be automated. And the argument about multiple package managers to juggle is only the case IFF there are…

> I honestly doubt it would happen if we enforced what a package is in the language. I just don't want to officially endorse one ever because I do view them to be evil. I don't see how changing package definition is going to help. JS had no concept of package and it was bolted on with NPM. If Odin becomes big enough, the community will override the will of the author. Plus I don't see huge benefits to not having a pa…

> If Odin becomes big enough, the community will override the will of the author.

Dunno, hanging out in the Odin discord, it definitely attracts a crowd that thinks similarly to Bill. All the "automate everything" crowd have definitely gone to Zig, where you can create automated monstrosities with the comptime stuff and build.zig files. And the crowd that likes NPM gravitates to Rust. So Odin is just fine IMO. People on the discord share libraries that actually do things, versus an entire dependency to write a few basic procedures.

And speaking of JavaScript, nowadays ES6 does have an idea of what packages/modules/libraries are and it's so much better. All my JS dependencies for my Rails projects are just .esm.js files. I choose modules carefully, don't pull in obfuscated files, read the source, so I have 2 JS dependencies in one project and a single one in another, I write the rest myself in vanilla JS and life is great.

Re: A critique of package managers

#219

Post by Ygg2 »

dismalaf wrote: post #218
Ygg2 wrote: post #212

Earlier quoted context omitted.

> I honestly doubt it would happen if we enforced what a package is in the language. I just don't want to officially endorse one ever because I do view them to be evil. I don't see how changing package definition is going to help. JS had no concept of package and it was bolted on with NPM. If Odin becomes big enough, the community will override the will of the author. Plus I don't see huge benefits to not having a pa…

> If Odin becomes big enough, the community will override the will of the author. Dunno, hanging out in the Odin discord, it definitely attracts a crowd that thinks similarly to Bill. All the "automate everything" crowd have definitely gone to Zig, where you can create automated monstrosities with the comptime stuff and build.zig files. And the crowd that likes NPM gravitates to Rust. So Odin is just fine IMO. People…

> Dunno, hanging out in the Odin discord, it definitely attracts a crowd that thinks similarly to Bill.

Sure, hence the big enough part. If you get big enough, you'll get people who are using it as a day job language, not their special darling. Having used JS and Java without package managers in a professional setting, they sucked to use.

You import a package, run the main program, see compiler/browser errors then search local repo or th Net for the missing library. Essentially you're the package manager. Which does little for bloat. You can still have a folder and import stuff en masse.

Re: A critique of package managers

#220

Post by marcelr »

lou1306 wrote: post #114
marcelr wrote: post #113

i had this idea for vendor based “package manager” what if packages were meant to be read, and config was set inside the file directly what if we transitioned to think of packages as templates, rather than generic black boxes i think it would drastically reduce dependencies, package complexity, and improve understanding

You can do this in Python, today. Whenever you need a package, just add its code in a directory under your project's root. And good luck.

how do you update the package?
Post reply on HN