Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM and Left-Pad: Have We Forgotten How to Program?

haneycodes.net

Post reply on HN
Print view View original

241–250 of 887 posts

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#241

Post by pcwalton »

ksenzee wrote: post #107
joantune wrote: post #87

Earlier quoted context omitted.

OR: you depend on a specific version of the library, that you know that works, and you have none of those problems.

You can't escape problems by bundling specific library versions. You just get a different set of problems. When you require a specific version of a library, you're making your code incompatible with anything that requires a higher or lower version of that library. You're also assuming there will never be a security fix that requires you to update your dependency.

And writing the code yourself instead of taking on a dependency solves none of these problems. Your code becomes incompatible with anything, because you wrote it yourself. And you are responsible for making any security fixes yourself.

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#242

Post by foobarian »

idlewan wrote: post #230
lewisl9029 wrote: post #206

Earlier quoted context omitted.

This comes up a lot when people discuss anything related to npm modules. It's easy to simply dismiss these trivial one-line modules as "insanity" and move on, but there's actually plenty of good reasons as to why many prefer to work with multiple small modules in this manner. This GitHub comment by Sindre Sorhus (author of over 600 modules on npm) is my favorite writeup on the topic: https://github.com/sindresorhus/a…

You'd have a good point, if all of those tiny but probably useful modules were given the use you're describing. Discoverability though is so poor that most of those modules are most likely just used by the author and the author's co-workers. If a typical npm user writes hundreds of packages, how the hell am I supposed to make use of them, when I can't even find them? Npm's search is horrendous, and is far from useful…

Another benefit of small well understood components is that they are easier to write tests for. Do these npm modules have good test coverage? Did the leftpad module have a unit test that would have caught the issue?

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#243

Post by nostrademons »

xdissent wrote: post #38

In the case of left-pad, 2538464 of its 2550569 downloads last month are attributed to dependents of the line-numbers package ( https://www.npmjs.com/package/line-numbers ). So it would appear that relatively few people directly rely on left-pad, which highlights the importance of vetting the dependencies of dependencies.

About 2/3 of those (1.7M) were from babel-code-frame, which is a core dependency of babel:

https://www.npmjs.com/package/babel-code-frame

And the fix was just to drop the functionality and inline the function as a no-op:

https://github.com/babel/babel/commit/09287643c712bcd203bbd6...

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#244

Post by lewisl9029 »

idlewan wrote: post #230
lewisl9029 wrote: post #206

Earlier quoted context omitted.

This comes up a lot when people discuss anything related to npm modules. It's easy to simply dismiss these trivial one-line modules as "insanity" and move on, but there's actually plenty of good reasons as to why many prefer to work with multiple small modules in this manner. This GitHub comment by Sindre Sorhus (author of over 600 modules on npm) is my favorite writeup on the topic: https://github.com/sindresorhus/a…

You'd have a good point, if all of those tiny but probably useful modules were given the use you're describing. Discoverability though is so poor that most of those modules are most likely just used by the author and the author's co-workers. If a typical npm user writes hundreds of packages, how the hell am I supposed to make use of them, when I can't even find them? Npm's search is horrendous, and is far from useful…

You're totally right. Most developers don't develop this way, and that makes the benefits of this approach far less pronounced than they would be if they did. It also doesn't negate the benefits entirely, of course.

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#245

Post by pcwalton »

ksenzee wrote: post #75
atjoslin wrote: post #11

Counter-argument: A good micro-module removes complexity. It has one simple purpose, is tested, and you can read the code yourself in less than 30 seconds to know what's happening. Take left-pad, for example. Super simple function, 1 minute to write, right? Yes. But check out this PR that fixes an edge case: https://github.com/azer/left-pad/pull/1 The fact of the matter is: every line of code I write myself is a comm…

> every line of code I write myself is a commitment That's true. However: Every dependency you add to your project is also a commitment. When you add a dependency, you're committing to deal with the fallout if the library you're pulling in gets stale, or gets taken over by an incompetent dev, or conflicts with something else you're using, or just plain disappears. If you add a dependency for just a few lines of code,…

> If you add a dependency for just a few lines of code, you're making a way bigger commitment than if you'd just copy/pasted the code and maintained it yourself.

This is a problem with NPM, not with dependencies. With different package management systems with stable builds and lockfiles, then you pin to a specific version and there is no way upstream can cause problems. A lockfile is a pure win over vendoring.

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#246

Post by sillysaurus3 »

lewisl9029 wrote: post #229
kbenson wrote: post #215

Earlier quoted context omitted.

The simple rebuttal to that is that modules that are collections of small functions are easy to reason about as well, and don't the downside of increasing the metadata management to useful function ratio nearly as much. Why have just an average (mean) function, when it makes sense to provide a median and mode as well? Even then, you might find that there's a bunch of extra math operations that are useful, and you mig…

With the advent of ES6 modules's selective imports and tree-shaking, that's definitely quickly becoming a better approach. With the old CommonJS modules, you need to be concerned about overall code size, which is where small, single purpose modules excel, and why this approach has proliferated to this degree.

I've been reading about tree shaking. I'm not at my laptop at the moment, so I can't settle this question by testing it. I'll toss it to the community:

https://news.ycombinator.com/item?id=11349606

Basically, how does tree shaking deal with dynamic inclusions? Are dynamic inclusions simply not allowed? But in that case, what about eval? Is eval just not allowed to import anything?

I've been reading posts like these, but they are pretty unsatisfying regarding technical detail: https://medium.com/@Rich_Harris/tree-shaking-versus-dead-cod...

Maybe someone else was wondering the same thing, so I decided to post it here before wandering off to the ES6 spec to figure it out.

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#247

Post by scrollaway »

meric wrote: post #236

NPM modules can be used on browsers. On browsers, space is a premium. Why would you want to install a 500kb dependency that has only one function you need, when you can install a 10kb dependency that has it? Would you want each of your five 20kb dependencies to re-implement the same 5kb function, increasing the code you must send to the client by 20%, or would it be more optimal for each of those dependency to use th…

It's quite ironic how you're lecturing people about dependencies and bandwidth when you yourself don't seem to have a good grasp in your mind of how immense even 5 kilobytes is (you talk about 5kb functions). 5 kilobytes (well, KiB) is 5120 bytes. That's about 200-300 lines of code. If you're talking about minimized code, maybe up to 500 lines.

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#248

Post by Bluestrike2 »

UK-AL wrote: post #188
Bluestrike2 wrote: post #147

Earlier quoted context omitted.

I can't speak for him, but upgrading really old Rails apps can get complicated very quickly. Especially when you're going across multiple major versions and have to deal with significant changes in Rails behavior and broken gems. "Rebuild" might not be the most accurate way to describe the slow, steady incremental approach you're forced to take (you aren't redoing huge swaths of your domain logic, for instance), but…

Rebuilding for most cases seems silly to me. I've been working on a .net web app, that's been around since 2008. It's been continually evolved, so it's running on the latest MVC framework, uses microservices etc As result it's build up a huge amount of automated tests. The business logic has been built up from experience and is well tested even for odd cases. You throw away a lot of stuff for a rebuild.

Oh, definitely. It's not something I'd recommend ever doing for the hell of it unless you're a real masochist. Even then, it might be easier if just broke out the floggers.

All kidding aside, if the concern is just for continued security patches, there's always Rails LTS [0]. You have to pay to play, but it's cheaper than a security breach or weeks of development time. But if you're dealing with significant performance issues or looking at major feature changes/additions, it might be more effective in the long-term to consider an upgrade. You just need to be aware of just how large a project that can turn out to be.

0. https://railslts.com/

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#249

Post by xamuel »

fredbot wrote: post #175

I call this kind of attitude the "Tea Party" of JavaScript development. The reason why we currently have JavaScript tooling fatigue is exactly because Tea Party developers insist on writing everything themselves instead of trying to build a better abstraction. The lesson here isn't not fewer dependencies: it's managing dependencies. NPM should not allow someone to arbitrarily remove modules that other's may be depend…

It's more like planting a bush in your front yard, and for some reason the metropolitan train system decides to use your bush's shadow to tell the time of day, and builds that into every aspect of the entire city's transportation network. Then you cut the bush down and everyone starves.

Re: NPM and Left-Pad: Have We Forgotten How to Program?

#250

Post by lewisl9029 »

rubber_duck wrote: post #240
lewisl9029 wrote: post #229

Earlier quoted context omitted.

With the advent of ES6 modules's selective imports and tree-shaking, that's definitely quickly becoming a better approach. With the old CommonJS modules, you need to be concerned about overall code size, which is where small, single purpose modules excel, and why this approach has proliferated to this degree.

Doea code size really matter to node.js ? And how common was commonjs (no pun intended) on the client before ES6 ? Also doesn't commonjs bundling add a significant overhead when talking 5 line function modules ?

Quite common actually (see Browserify)! In fact, the increasingly widespread use of npm and CommonJS on the client is one of the factors that motivated the npm team to transition to flat, auto-deduplicated modules in version 3.
Post reply on HN