Comment by julvo | Hacker News Reader

Comment by julvo | Hacker News Reader

The two most frequent arguments against using URLs instead of npm packages seem to be: 1) Security: What if someone changes the code behind a URL? 2) Hard-coded versions in application code

I don't think these arguments are valid. For 1) you can always limit the URLs you use to hosts like jsDelivr or unpkg and reference npm packages directly. In this case instead of trusting only npm to send you the code you requested, you're now trusting the CDN as well. Potentially even better could be to import scripts from Github directly. For 2) a simple solution could be to have a deps.ts file for your project where you import from single-version URLs and export the dependency version-unaware. Now your versions are not scattered throughout your application code.

To me URLs seem like a nice (because compact and universal) interface for dependencies which allows decoupling your package management from your runtime.

So, in order to solve 1) and 2), we should return to what every other language does? That sounds like a design mistake...

What do you mean by "URLs are compact"? How can a URL be compact compared to the same URL in some sort of dependencies file? Unless you use the dependency once, of course, which is rare.

URLs and explicit versions in the import also encourage you to use several versions of the same dependency in your code, which is a very bad idea.

NPM’s model of referencing packages from central repositories is bad for many reasons proven over the years. But referencing GitHub scripts and arbitrary URLs is even worse.

URLs are compact as in a single string they specify everything you need to locate and use the dependency and you don't need any context, like a specific dependency manager (incl some sort of dependency file). I guess I mean compact as in self-contained, not necessarily short.

That’s fair and I’d agree it could be a useful property for scripts and even small apps if all code was trusted and all networks had perfectly availability.

Sadly, that is not the case, which is why I don’t see the advantage of going "the browser way" for local scripts.

Reply on news.ycombinator.com