Hacker News Reader

Comment by rcfox | Hacker News Reader

Worse than Javascript's 5+ different types of mostly incompatible module formats, transpilers for different version targets, megalithic node_modules directories and the community's love of importing new packages for one-line functions that can disappear and take down the internet?

View on HN

As much as we all have criticized the npm ecosystem, after seeing what exists in the python world I actually came round to it and consider it very good.

How is `node_modules` different from `/path/to/venv/lib/python3.X/site-packages` ?

Are PyPI, cargo, Maven, etc... all immune to supply chain attacks?

One major difference is a venv doesn't allow nested dependencies. With npm, you might install version 2.3 of a package, only to find that some other package has installed version 1.4 under itself.

Python also has "wheels", which are pre-compiled distributions, rather than full-source distributions. These are often smaller and install faster.

> One major difference is a venv doesn't allow nested dependencies. With npm, you might install version 2.3 of a package, only to find that some other package has installed version 1.4 under itself.

a feature not a bug. Anyone who ahs built a sufficiently large project and had to abandon some dependencies know this pain

Javascript is a larger technical mess once you pull it open and look inside.

But for day to day use it's much better than Python. They've done a fantastic job overall allowing you not to need to worry about all the different formats and transpilers and whatnot.

Yes. Which is quite impressive.

Reply on news.ycombinator.com