[duxup]

>Javascript developers have a whole different culture than the developer circles I like to frequent.

Most Javascript developers I know are just writing code and that's what they're concerned with.

Vocal voices on twitter or etc != most Javascript developers.

I'd argue most vocal folks on forums or etc don't represent most developers of any given language.

[HideousKojima]

Sure, just like most men aren't violent criminals but men are still statistically more likely to be violent criminals. The point is that JS devs seem (perhaps a proper statistical study will show otherwise) more likely per capita to shit up their ecosystem. There are several reasons contributing to this (the limited JS standard lib being a big one) but a major part of it really seems to be that JS devs are a different breed.

I've never seen controversies like this in the .NET/Nuget ecosystem, the only controversies I've ever seen there are over libraries changing licenses to make the authors more money, and controversies over Microsoft exercising too much control over the ecosystem.

[Tade0]

> but a major part of it really seems to be that JS devs are a different breed.

Can you really make such generalizations considering there are millions of JS devs, some of them not working exclusively in this language?

[throwaway7033]

Here are some package counts(http://www.modulecounts.com/) for different platforms:

* npm - (1,916,619)

* Maven - (465,713)

* NuGet - (299,957)

npm has about 2.5 times the number of packages as Maven and NuGet combined; it's not surprising that it has more drama than other ecosystems.

[pbourke]

> I've never seen controversies like this in the .NET/Nuget ecosystem

Some .NET ecosystem projects have put political messages on their documentation over the past couple of years.

[gs17]

I think they meant "controversies" more in the "adding malware to a common dependency" sense.

[devmunchies]

> men are still statistically more likely to be violent criminals

I think your meant criminals are more likely to be men.

[HideousKojima]

No, I meant exactly what I said, more men are violent criminals per capita than women. What you said is also true, but it's not what I meant.

[NhanH]

Moreover, unless we are talking about a very unusual subset of the population, the ratio of men:women is always almost 1:1, which renders the two statement functionally equivalent

[devmunchies]

Oh you meant in relation to women. I misinterpreted that you were saying if you pick 10 men, then over 5 of them are violent criminals.

[lobocinza]

They're equivalent, in this case.

[gruez]

They're both talking about the same phenomena and are technically correct, but the framing is different. Specifically, the latter wording tries to defuse blame on males.

[nimih]

> I'd argue most vocal folks on forums or etc don't represent most developers of any given language.

Sure, but for some reason, this stuff seems to only happen in the JS community (at least to my knowledge and recollection, which admittedly may be faulty). Maybe it's the fault of the tooling or the language, but python is another popular language which has historically had quite a messy answer to dependency management, and I don't remember ever hearing about an open source python developer throwing a hissy fit and trying to wipe the hard drives of everyone who uses their software.

[duxup]

>this stuff seems to only happen in the JS community

What stuff? Drama? That happens everywhere.

Malware? That stuff happens a lot of places, maybe npm makes it more accessible but that's just a technical hurdle ... doesn't mean it wouldn't happen elsewhere if folks could do it easily.

[nimih]

I'm talking about the particular sort of incident mentioned in the grandparent post, where a dev gets a bee in their bonnet about something or other and decides to purposefully screw over their users. Other ecosystems have had supply chain attacks of course, but something about JS seems to really encourage turning run-of-the-mill internet drama into CVEs and broken software.

Maybe, as you say, it's a technological problem. However, if that's the case, it's an eminently solvable one, as evidenced by the fact that I've never in my life had to avoid bumping my Java dependencies because I'm worried my CI pipeline will be overrun with heart emojis, and the fact that the JS community has not solved it just points to a different kind of un-seriousness.