Comment by dmacvicar | Hacker News Reader

Comment by dmacvicar | Hacker News Reader

While I have seen what you describe, I am not sure if it is only specific to Java, and I have to admit that I enjoy working with the Java platform. There are things in the ecosystem that annoy me more.

We use Java in a non-standard environment: products built on a enterprise Linux distribution, and therefore built using the same infrastructure and conventions: everything is built from source as a dependency chain, so that you can patch it and provide support, and ship those patched components back as packages. Everything is built in a repeatable environment, jailed in a VM, no network, that only contains the dependencies you declared.

So there were those nice times where building a Java library meant packaging 2 or 3 dependencies, then packaging the library was as simple as unpacking, apply any patches, set the classpath to the dependencies and run ant. Then install the resulting jar. It played well with the environment.

Java build tools are insane.

To build most libraries I now need Maven. Maven needs like a hundred dependencies to build, plus some plugins that need those dependencies, and those plugins build with Maven, the dependencies too. At the end, to build Maven, you need to have all components which are the reason you are building Maven in the first place.

So this makes me thing Java developers don't think in terms of layers, and they pull dependencies without balancing the costs (writing one function vs depending on 20 more jars).

A build tool should have almost no dependencies outside of the base system (in this case the JDK) and the compiler.

But no, they added even a Dependency Injection container. And now they realized that the one from Google is better, so they switch to it, but without removing the old. So now they may be depend on 150 packages instead of 100. Great. Lets add more stuff.

Imagine if to build make you need to have Gtk, and a library that builds with cmake and another library that builds with scons.

And all the noise with this advanced nuclear engines and frameworks to power something as simple as a build tools is at the end useless. At some point the project still declares technical bankruptcy and dies. Java has a lot of "choice" in terms of libraries, but a good percentage of them are dead projects.

Programmers rarely see how their software is built and shipped. Those who have this opportunity rarely have their taste developed to see that external dependencies have cost associated. And it's not something specific to Java: I see the same in Ruby and Python.

It could give the perspective to programmers requiring from them that they always build their software on a freshly installed machine with no network connection.

That is why I don't understand the "enterprise" sticker they try to put on some Java stuff.

Building without network connection was a feature most of these enterprise "build tools" did not get right from the beginning.

Patching a dependency, rebuilding the affected chain and ship it back to the customer is something I still ignore how the Java ecosystem does with their native tools.

Probably they just do "mvn" in their workstations and .zip the output folder.

Are you really generalising to an entire industry from the build procedure for a build tool? Why are you even building Maven in the first place? My experience with Maven has been:

1) Download and unzip

2) Run it

and that's all that was necessary. Meanwhile on the fly dependency resolution is very nice and a feature of most modern platforms.

I think I already mentioned why Linux distros build the entire chain from source: they provide support for it, they need to be able to patch it and they can't take responsibility for binaries built in an unknown environment.

However, I don't understand why you mix two things: maven concept and design (which is fine) with what I criticized: a build tool that depends on everything that it intends to build in the first place.

Bootstrapping any tool is going to look that way. To compile gcc you need a C compiler don't you?

Yes, but gcc requires gcc and THAT is. gcc does not require KDE and apache to build (which is like Maven dependency chain looks like).

You probably are angry at the "length" of the dependency chain, but I see no conceptual difference between the two bootstrapped tools.

Of course, I am looking at this far from the battle-field, so maybe I am being too non-chalant.

So Maven is at fault because they prioritise their own development productivity over ..... Linux distributors?

Why package Maven anyway? You aren't likely to add much value by doing that.

I think what you call "development productivity" shows exactly the cancer that makes the Java ecosystem a spaguetti of jars (whith some of them being dead projects) instead of a lasagna where you see libraries use only other libraries from the layer "below".

But not, it is the obsession to turn everything into agnostic "engines" and meta-somethings, where everything is abstracted to the extreme with little value. At the end, Maven implementation using XML, plugins, dependency injection and having a build dependency chain of 100 packages did not prevent them from being kind of stuck in version 3 and slowly abandoned for another tool (gradle), leaving behind the only important value: conventions and the repository concept.

I can build/bootstrap ant and ivy just fine. And I can build almost every package using it by just telling them, don't go to the network, but use the one I already built myself with little effort.

If you ask why maven had to be packaged, mostly because it had to be patched with ugly hacks.

Well, there's exactly the reason I try and avoid distributor packaging as much as possible and prefer to use Maven from upstream. Not only is it much simpler but it means it's not being patched with "ugly hacks" by people who dislike the project. Sorry, Debian proved multiple times that this whole arrangement is a recipe for disaster. Maven is convenient and fast, I think I'll stick with it for now.

So what do you do if you realize one of your dependencies has a very bad security issue that will not be fixed upstream for a while and you need to fix it and ship an update to the customer? (or the same example with a crash bug in one jar, and you can't workaround it)

Reply on news.ycombinator.com