| ▲ | 1GZ0 4 days ago |
| The Author isn't arguing for not using third party dependencies.
He's arguing for developers to be more conscious of the dependencies they use, by manually vetting and handling them. That screams "I've been down the package manager route and paid the price". Not inexperience. |
|
| ▲ | SideburnsOfDoom 4 days ago | parent | next [-] |
| > He's arguing for developers to be more conscious of the dependencies they use "be careful all the time" doesn't scale. Half of all developers have below-average diligence, and that's a low bar. No-one is always vigilant, don't think that you're immune to human error. No, you need tooling, automation to assist. It needs to be supported at the package manager side. Managing a site where many files are uploaded, and then downloaded many times is not a trivial undertaking. It comes with oversight responsibilities. If it's video you have to check for CSAM. If it's executable code, then you have to check for malware. Package managers are not evil, but they are a tempting target and need to be secured. This can't just be an individual consumer responsibility. I can't speak for other ecosystems, but some NuGet measures are here: https://devblogs.microsoft.com/dotnet/building-a-safer-futur... https://learn.microsoft.com/en-us/nuget/concepts/security-be... I believe that there have been (a few) successful compromises of packages in NuGet, and that these have been mitigated. I don't know how intense the arms race is now. |
| |
| ▲ | pjc50 4 days ago | parent | next [-] | | > "be careful all the time" doesn't scale Yes, this is the C attitude, where you provide no safety rails or poka-yokes or, indeed, package managers, and therefore you get a lot of fragile reimplementations of package managers (autoconf, anyone?). But you get to keep the satisfaction of blaming the users. nuget is pretty good. It helps that packages tend to be substantial things, not left-pad. | | |
| ▲ | 1718627440 4 days ago | parent | next [-] | | > autoconf, anyone? GNU Autoconf isn't a package manager, it's more an analogue to a setup executable on MS Windows, to detect where the user wants stuff to be installed, where the user has stuff already installed and which features the user wants. | |
| ▲ | SideburnsOfDoom 4 days ago | parent | prev [-] | | > It helps that packages tend to be substantial things, not left-pad. Agree, this is IMHO also a better pattern. 1-liners or even 20-liners are not worth the overhead of extracting a package. Or of depending on a package. |
| |
| ▲ | cayleyh 4 days ago | parent | prev | next [-] | | "Half of all developers have below-average diligence" - a lot of this is also not developer choice, but environmental. So much software is developed and maintained in very constrained economic environments, often by solo devs who also have other responsibilities. The choice here often is trading some "diligence" for "meeting business requirements in the time / budget constraints" imposed by your employer. | | |
| ▲ | SideburnsOfDoom 4 days ago | parent [-] | | Absolutely true, but still indicates the need for tooling, for automation, and for oversight at the the package store. "developers, be more conscious" isn't going to fix all the issues. In general, there are not individual effort fixes to systemic issues. |
| |
| ▲ | ozim 3 days ago | parent | prev [-] | | That's not package manager problem that's registry problem. NuGet is not having as many problems as NPM but also NPM is much more popular. NPM is also quite a wild west when it comes to publishing packages, any kid can make an account and publish 'left-pad' kind of crap. We already have quite safe and working setup with APT and software repositories for Debian, Ubuntu etc. While it is not so easy to publish your software to Debian, you get dedicated maintainer and all kinds of requirements you have to fulfill. But this way all the issues with trust are if not mitigated, they are minimized and for example XZ Utils hack didn't make it to production systems and it took 3 years to prepare and pull it off. | | |
| ▲ | SideburnsOfDoom 3 days ago | parent [-] | | > That's not package manager problem that's registry problem I do not think that the two are cleanly separable. They are client and server ends of the same system. And I think my point is that I view it as more of a server (registry) and governance problem than the OP author does. Despite the fact that my employer also has an internal package feed, the security of nuget.org and the central public feed is intrinsic to the security of the whole system. Nuget was closer to the NPM end of the spectrum, but has tightened up considerably over time. Particularly the "Package ID Prefix Reservations" feature tells me that package names that start with certain words are owned by the relevant entity, be it "System." or "Azure." from Microsoft, or "AWS" from Amazon. This is important as it's used to distribute SDKs and optional but standard library components and updates. There is certainly junk on there, but not much load-bearing junk. | | |
| ▲ | ozim 3 days ago | parent [-] | | Article is discussing „package manager” as generic concept. My argument was that this concept is not the problem. Problem is in governance of NPM while NuGet or Maven are stricter and therefore it is registry governance problem. But on the other hand NPM is much more popular than any other registry. | | |
| ▲ | SideburnsOfDoom 3 days ago | parent [-] | | > Article is discussing „package manager” as generic concept.
My argument was that this concept is not the problem.
Problem is in governance of NPM Then we're in agreement that the article's author has the wrong end of the stick, by focusing on the client end of the file transfer connection. | | |
| ▲ | gingerBill 3 days ago | parent [-] | | Huh? I am not saying the repositories have (or should have) no responsibility, but you are also responsible for your own actions. The popularity of such repositories and package managers are due to users of them. And the concepts are trivially separable in my opinion. A package manager uses a repo of packages to download from. You don't need a package manager to use a repo. And a package manager could be just local to your machine and thus not need an external repo either. I know in practice the two are combined but that doesn't mean they are not distinct concepts. |
|
|
|
|
|
|
| ▲ | pipes 4 days ago | parent | prev | next [-] |
| But titled the post "package managers are evil" |
| |
| ▲ | Defletter 4 days ago | parent [-] | | > The term “evil” is being used partially hyperbolic to make a point. Kind of bonkers this even needs to be said, and even then it's missed/ignored. | | |
| ▲ | rgoulter 4 days ago | parent | next [-] | | The title is provocative and attention grabbing. -- It's completely fair game to react to the provocation rather than the substance of the article itself. (Or, rather, it's silly to use attention grabbing rhetoric, then complain that people paid attention to the rhetoric). I'd prefer instead a more balanced title like "Remember to Consider the Costs When Using Package Managers", or whatever. | | |
| ▲ | 1GZ0 4 days ago | parent | next [-] | | > It's completely fair game to react to the provocation rather than the substance of the article itself. Yeah, but its down right stupid to do so. The title isn't even misleading or part of a Motte-and-bailey argument. People just hear "Package Managers are Evil" and assume that the author means you shouldn't use third party dependencies. Which is NOT what's being argued. But I guess you'd know that, if you read passed the title. | | |
| ▲ | rgoulter 4 days ago | parent | next [-] | | In the article, the author does say "I am not advocating to write things from scratch", while also describing third party dependencies as liabilities (e.g. security vulnerabilities), that people are too trusting of third party dependencies, that people overestimate the quality of third party dependencies. I think you're splitting hairs if you're saying that these points from the article argue against package managers but don't argue against using third party dependencies. I similarly think you're splitting hairs if to consider "package managers are useful?" and "third party dependencies are useful?" as distinct points. | | |
| ▲ | 1GZ0 3 days ago | parent [-] | | Liability: "Something for which one is liable; an obligation, responsibility, or debt." Third party dependencies absolutely are liabilities.
You are liable to vet them, inspect their licenses and keep them updated while ensuring that they continue working with your existing code. This is not something package managers help you do.
Package managers like NPM make it trivial to skip these steps entirely. What is being argued for, is a more thoughtful approach to handling third party dependencies. Or at the very least, the need for people to realise that there are costs associated with bringing third party dependencies into your codebase. Its not splitting hairs at all.
Its more of an presumption on the part of a large number of readers, that the 2 points argued conflate to "Package manager suck, because third party dependencies suck and you should write everything from scratch instead". | | |
| |
| ▲ | papichulo2023 4 days ago | parent | prev [-] | | Sorry but I lack any respect for authors that use clickbaits. Call them put and move on seem the best approach. | | |
| ▲ | 1GZ0 3 days ago | parent [-] | | Its not clickbait though. You should try reading the article before passing judgement. Its not like the article is called "5 facts that will make you hate package managers. Number 5 will shock you" | | |
| ▲ | ModernMech 3 days ago | parent [-] | | It was clickbait because the article, which I did read, did not support the contention that package managers are evil. Therefore "evil" seems to be used in a hyperbolic way to grab attention, which makes it clickbait, specifically ragebait. | | |
| ▲ | gingerBill 3 days ago | parent | next [-] | | I wouldn't class it as clickbait myself, but I will stand by the use of the word "evil". I am using evil in the very old fashioned sense: the privation of the good. Is the title provocative? Yes. But that's the point of the article in general. I am trying to argue that they are a net bad with virtually no good upsides to them for the programming world as a whole. They've automated something at scale which should not have been automated. And to be clear, there is no solution to the problems they are trying to solve, rather it's all about trade-offs. I a little annoyed that HackerNews post renamed it to "A critique of package managers" because that implies very different connotations. I'd view an article written like that as if I have some criticisms that could be addressed, rather than the entire concept being bad from the start. | | |
| ▲ | ModernMech 2 days ago | parent [-] | | > I am trying to argue that they are a net bad with virtually no good upsides to them for the programming world as a whole. What I'm saying is that you have failed in this argument. You hardly even attempt to make it. Thus clickbait. You said "this is why I am saying it is evil, as it will send you to hell quicker." Okay, so then it's up to you to prove this hell actually exists. But you don't. You just assert its existence -- "Dependency hell is a real thing which anyone who has worked on a large project has experienced." By framing it this way, you can dismiss anyone who claims to not have experienced this as not having sufficient experience. But reading the comments here, a lot of people have experienced a sort of "dependency hell" (the kind that's talked about in the wiki you link to) that is solved by package managers. So that's why it's classed as clickbait -- you (admittedly) wrote a provocative headline that you don't even remotely back up. FYI for the future since you're lamenting in many comments that people are misinterpreting you, this is why. Given that you don't really make an attempt to prove this dependency hell and package managers are evil, and you don't acknowledge anything good about them, it's reasonable to assume your bias is just that dependencies are evil at their core. It's actually the most charitable reading because otherwise you seem confused. |
| |
| ▲ | wannadingo 3 days ago | parent | prev [-] | | Then again, there is a trope going back to Knuth - "Premature optimization is the root of all evil" - which is an argument that it is not clickbait, but merely applying a pattern in discussions about computer programming. | | |
|
|
|
| |
| ▲ | cxr 2 days ago | parent | prev | next [-] | | > The title is provocative and attention grabbing. -- It's completely fair game to react to the provocation rather than the substance No it isn't. | |
| ▲ | gingerBill 4 days ago | parent | prev [-] | | The title of the article comes from the direct words I said in the video, of which the article is effectively a polished transcription of. Your "more balanced title" isn't even close to what I am saying. I am saying that Package Managers are just bad and should not be used. Not "remember to consider the costs". The net cost is bad for everyone, that's why I said "evil". |
| |
| ▲ | procaryote 4 days ago | parent | prev [-] | | I guess clickbait is evil |
|
|
|
| ▲ | ozim 3 days ago | parent | prev [-] |
| I disagree with this take. There should be just more governance on the registry side of things. For NuGet or Maven I think dependency hell is not something you run into and I don’t have package manager manager for those languages. There should be enough trust just like I can do sudo apt install. His take screams „I want to push my niche approach and promote my language from my Ivory Tower of language creator”. He still might not have any relevant experience building businesses line software just like O don’t have experience with building compilers or languages. |
