Hacker News Reader

Comment by jwr | Hacker News Reader

I always wondered why people found it acceptable to just run npm on their systems for anything they do, and have it download anything on any build.

Coming from "make" with repeatable and predictable builds, I was appalled that you run this thing and you have no idea what it will download and what it will produce. Could be something different the next time you run it! Who knows!

I also found it bizarre that even for things that just generate CSS, you are expected to integrate it into your npm thing. I mean, generating CSS from a configuration is a function. It's a make recipe. Why does it need to be an npm library dependency with all the associated mess? I managed to work around it for a number of packages by freezing entire npm setups inside docker containers, which gave me reproducible builds — but it's a losing battle.

View on HN

> entire npm setups inside docker containers

Did you then spend a month or two inspecting that setup? Did you do that after every dependency upgrade?

Also both NPM and PNPM already freeze dependencies for you by default without any arcane docker setups.

> Did you then spend a month or two inspecting that setup? Did you do that after every dependency upgrade?

TBH, I never updated some of the setups. What's the point? Their job was to generate a CSS. Why would I want to upgrade dependencies or inspect that setup?

> arcane docker setups

I take issue with "arcane" — I have much more "arcane" setups than these :-)

makefiles /can/ do whatever you like. They can download anything on build.

Downloading things that you don't know about its common for every modern package manager out there, from maven, to nuget, to pip and npm. This is the new norm and there are reasons for it.

I don't think the old C/C++ way of relying on distro package managers would allow for the fast ecosystems people work nowadays.

Things are changing though, and people are pushing for more secure package managers with the same feature set as the old ones, which is possible.

I think this is the missing piece on the first wondering part of your comment. But I don't think we should be bashing the means without understanding the reasons

> freezing entire npm setups inside docker containers, which gave me reproducible builds

How does that work when enevitably those npm packages are shown to have vulnerabilites?

The entire Front end dev seems like trust me bro Wild West to me. All feels like endless layers of duct tape. Which I guess in a way it is given the evolution of browsers

it seems a lot worse with NPM for some reason, but the underlying weaknesses apply to language package managers in general too.

I think it is worse with npm because there are more people using it and more people know about it.

Lowering the barrier to entry is not paying off, for sure.

I think part of the reason is the embrace of an "each package should do exactly one thing" by many in the community, often taken to a ridiculous extreme. Possibly better now after left-pad and other similar incidents.

This is true for every moser package manager out there: pip, cargo, gradle and the lot. It is not about front end dev

I've seen gnarly code everywhere, from kernel drivers to desktop applications to web apps. At the end of the day this describes most of computing imho.

'Npm install thing' is easier than programming or even auditing imported code.

Too lazy to write, too cheap to pay for it, that's half of open source.

Now what's going to dominate stackoverflow answers, thoughtful articles on how to program? Or gratis npm/uv installable libraries that hide the actual solution details in between tests and polyfills and readmes, that end up just download another dependency while contributing enough lines of code so that the author can safely put it in their resume and grift over the oss ecosystem to get a cushy 300k/yr job at an extended faang where they are in charge of an ad pixel tracker or yet another one of those wallet things that are just an IO proxy for money but they get to keep some comission if they spend enough money on ads to convince someone to use the thing once and then it becomes their main neo(not) bank* forever.

*for regulatory reasons we must not call it a bank, but it's a bank

Reply on news.ycombinator.com