Hacker News Reader

Comment by kunley | Hacker News Reader

Why the biggest package mess is always with the Node ecosystem?

Why in particular this community still insists on preemptively updating all deps always, on running complicated extra hooks together with package installation and pretending this all is good engineering practices? ("Look, we have so plenty of things and are so busy, thus it must be good")

Why certain kind of mindset is typical to this community?

Why the Node creator abandoned his creation years ago?

Why, oh why?

View on HN

Node is the new PHP: massive ecosystem, enormous mind share, and made up for a large part by programming newbies for whom JS is their first language and have no serious understanding of engineering practices, security and quite eager to use a library rather than wasting hours figuring out how to pad a string.

Because it is not a serious ecosystem run by serious people. Do you know what serious people do? They have package repositories with people called "maintainers", who are, crucially, trusted members of a community who don't write the software they package. "Oh but that's GATEKEEPING!", they screech. Yes, that's the entire point. Gatekeeping prevents shit like this from happening. There's a reason why this doesn't happen to Debian, but JavaScript developers get defensive and mean when you suggest that maybe the equivalent of a public S3 bucket isn't the best way to host a package repository.

Agreed that some level of gatekeeping and some level of friction to protect quality are useful things.

Feels good, just for a second, to type pretence you're above everyone doesn't it? Just for those few seconds, you're better than a big whole arbitrary collection of people, and for those few seconds you have relief from the reality of your life.

No. I am tired of seeing people dragged into poor quality environments for the wrong reasons. These people would do much better using other tools.

Your attempt to make it personal does not compute.

Well it certainly doesn't feel good to get your shit pwned every two weeks.

The reality of my life is that I have to write code targeting Node because of choices that other people made for their libraries and products.

I didn't hate JS & npm with a passion before. I do now, and it hasn't even been two years.

Reply on news.ycombinator.com