A little copying is better than a little dependency.
A one-line package broke `npm create-react-app`
221–230 of 478 posts
Re: A one-line package broke `npm create-react-app`
#222Earlier quoted context omitted.
haha i understand what you mean, but debian's https://wiki.debian.org/DontBreakDebian page is not an accident :) i made my comment more as a joke, shit happens everywhere, and as i said maybe not to this extend.
All of this is telling users how to avoid breaking Debian, and mistakes that they ought to avoid. This isn't Debian being broken and the users being collateral damage. This isn't a symptom of the very Debian ecosystem itself being fundamentally broken.
i have been using debian since potato, and i have seen some damage :D
Re: A one-line package broke `npm create-react-app`
#223Earlier quoted context omitted.
create-react-app contains over 1000 packages. How long would it take to review all of those?
There are alternatives to create-react-app. In fact, there are alternatives to React.
Of course - this issue isn't unique to create-react-app or React, most Javascript frameworks have a similar explosion of dependencies.
A quick check of angular-cli and vue-cli shows that an empty project uses 870 and 816 dependencies respectively.
Re: A one-line package broke `npm create-react-app`
#224Earlier quoted context omitted.
> Not everyone would use it If the right people would provide the library, it would be used by enough people. > Yes, in my mind you'd have to change everything from the ground up, starting with no longer using javascript outside of the browser Whats the point of inside or outside of the browser?
The point is that different languages are best suited to different tasks. Javascript is a simple, very loosely typed scripting language with prototypal inheritance that was developed to be run in the browser. It's a DSL, not a general purpose programming language. Using it elsewhere for applications where another language with stronger and more expressive types would be more appropriate requires hacks like compiling…
> It's a DSL, not a general purpose programming language
Sorry, but I fear that ship has sailed ;-)
And I've heard JS was developed by someone who wanted to give us Scheme (you can't go more general purpose than that) but had to resort to a more "friendly" java-syntax. IMHO javascript would be a great general purpose language if the ecosystem wouldn't be such a mess.
Re: A one-line package broke `npm create-react-app`
#225The problems that beset the Javascript ecosystem today are the same problems that beset the Unix ecosystem, back in the 90s when there still was one of those. TC39 plays the role now that OSF did then, standardizing good ideas and seeing them rolled out. That's why Promise is core now. But that process takes a long time and solutions from the "rough consensus and running code" period stick around, which is why instan…
And your example is why we have the "lol javascript trash amirite" chorus, because as you've noted these problems were solved decades ago. Yet for some reason, the JS and npm ecosystems always seem to have some dependency dustup once or twice a year.
Yes, that's largely my point. I'm not sure why it is surprising to see an ecosystem, twenty-five or so years younger than the one I compared it to, have the same problems as that one did twenty-five years or so ago.
Re: A one-line package broke `npm create-react-app`
#226Earlier quoted context omitted.
Here's my off-the-cuff take that will not be popular. A function like this should be a package . Or, really, part of standard js, maybe. A) The problem it solves is real. It's dumb, but JS has tons of dumb stuff, so that changes nothing. Sometimes you want to know "is this thing a promise", and that's not trivial (for reasons). B) The problem it solves is not straightforward. If you Google around you'll get people sa…
I don't think it should be a package. One-liners without dependencies like this should live as a function in a utility file. If justification is needed, there should be a comment with a link to this package's repo.
What's the difference between a utility file and a package? That seems like a distinction without a difference to me.
If you use the same one liners in more than one project and you copy that utility file over, the line gets even fuzzier.
Re: A one-line package broke `npm create-react-app`
#227The problems that beset the Javascript ecosystem today are the same problems that beset the Unix ecosystem, back in the 90s when there still was one of those. TC39 plays the role now that OSF did then, standardizing good ideas and seeing them rolled out. That's why Promise is core now. But that process takes a long time and solutions from the "rough consensus and running code" period stick around, which is why instan…
> running code straight from wherever on the Internet it happens to live today.
This, exactly this. Young me thought this was a point of the whole thingy we call Internet.
And exactly that is what I like about QML from Qt. Just point to a file and that's it.
Re: A one-line package broke `npm create-react-app`
#228I feel the real issue here is downstream package consumers not practicing proper dependency pinning. You can blame the Node ecosystem, the maintainer of the package, etc. but there are well-known solutions to prevent this kind of situation.
So you would exchange security for stability, if you use package pinning then you will end up with fosilized packages in your product, which will have all maner of security issues that have alresdy been fixed.
Re: A one-line package broke `npm create-react-app`
#229Call me crazy, but... I don't add things to my projects without looking at the source. Mostly because it saves me from shit like this. If I see something is small enough, and easy enough to reason about, I'll just copy-pasta that motherfucker with a comment citing the source and date it was pasta'd (license permitting). Things like this are so not worth a package, ever, it's something when you see it you go "oh yeah,…
Unless the packages you're adding are trivial I seriously doubt you're looking that close. Are you really going to code review 20000 lines of someone elses code every time you're adding something? 100,000? Also their dependencies? Those are very reasonable numbers by the way.
Re: A one-line package broke `npm create-react-app`
#230The problems that beset the Javascript ecosystem today are the same problems that beset the Unix ecosystem, back in the 90s when there still was one of those. TC39 plays the role now that OSF did then, standardizing good ideas and seeing them rolled out. That's why Promise is core now. But that process takes a long time and solutions from the "rough consensus and running code" period stick around, which is why instan…
> Deno appears to be trying to become the Linux of Javascript Deno always sounded more "like the Plan 9 of Javascript" personally to be honest. It seems to be better (yay for built-in TypeScript support! Though I have my reservations about the permission management, but that's another discussion) but perhaps not better enough (at least just yet) to significantly gain traction.
Deno was always Typescript-first fwiw