Hacker News Reader

Comment by mdszy | Hacker News Reader

How many times have you run `npm install` or used literally any programming package management system without personally reading every line of code that you're installing?

View on HN

If I'm going to use some library, at a minimum I read the API docs (getting a sense of the quality of the library from how well-thought-out the API is and how well-written the docs are). That's a long way from copy-pasting a few lines of code from SO without understanding what they do.

Furthermore, it's a lot easier to take the time to understand what a few lines of code from SO does than it is to audit a dependency thoroughly.

I have thankfully avoided the world of NPM, but when I've had to use it I've found it very difficult because a lot of packages don't really have API docs.

It's a lot easier to read a few lines of code from a Stack Overflow answer than it is to read thousands of lines in libraries...

Well, if you are going to be passing something as your own work, you better understand it well.

Also, you should look at least at the docs of the packages you install.. And since most SO answers are shorter that introductory section of most docs, this means reading and understanding entire answer.

>Also, you should look at least at the docs of the packages you install

Brb reading the docs for every micro-package installed as a dependency for what I just installed that provides functionality that could've been hand written in five minutes.

Gonna spend the next few months reading about a thousand package README's for this single package I installed and all its dependencies down the tree, be right back.

You say that like it's not a good thing to do? If you pull a library into your project, you're taking responsibility for that library, for better and worse.

I'm talking about how that's completely not feasible anymore because of how every project has dependencies upon dependencies upon dependencies because the general development attitude has shifted towards "import a single library that tells you if a number is odd, and another library to tell you if one is even"

Ultimately, if a bug in a library causes issue with your program, and your company loses $X, your superiors will not give a shit. You have the burden of responsibility for the program.

For common major libraries used worldwide in enterprise products, you are right in that there is an element of trust. They are made by people much faster/better/stronger than most of us. If all else fails, the sheer magnitude of people using it is a small insurance policy, as disastrous issues will probably be quickly apparent. That still doesn't absolve you of responsibility, but the overall risk is usually pretty low.

A segment of code on SO, or a weeny niche library? You only have your noggin to vouch for its stability and accuracy.

>They are made by people much faster/better/stronger than most of us.

lmfao no they're not

> You have the burden of responsibility for the program.

What does that mean when the developer who committed it might have left long ago? I'm assuming you mean more than "blame" which is a pretty unhelpful response for a company to have, but then what exactly is "burden of responsibility" which should have this bus-factor-of-1 attitude around it, and why?

No, the way it works you read the docs for the packages you directly use (import from code), and you hope that package authors did the same for their dependencies.

(this encourages one to keep number of at least dependencies small, which is pretty good idea in general)

You're just making an argument against the NPM model of installing five billion packages

> Also, you should look at least at the docs of the packages you install

There was a post recently that noted that React is up to over 800,000 dependencies. Good luck with that.

Reply on news.ycombinator.com