Hacker News new | ask | show | jobs
by croes 1403 days ago
NPM isn't just a package manager, if you don't exist on NPM you are nearly invisible.

Don't downplay it's importance and it's disadvantages that came along.

There are too many examples where changes to packages have had serious consequences.

Left pad and node-ipc to name the better known.
2 comments
tomphoolery 1403 days ago
These problems exist with every package manager, and every ecosystem of reusable modules that can be downloaded from a 3rd-party location. The problems that `left-pad` caused are minuscule compared to the ones created by Log4J. It's just the trade-off you make when you download a package from the internet vs when you write the code by hand. NPM may have more instances these days because it happens to be the most popular, but CPAN had the same problems over 20 years ago. The next package ecosystem to come along will also inherit a vulnerability to supply chain attacks, being part of the supply chain.

I don't think NPM is the best way to create a package manager, in fact there are many choices they made that I think are rather stupid and led to many more problems than there needed to be (whoever decided that the default for `npm add` should be a caret dependency instead of a tilde should never be allowed to work in the industry again, IMHO). But I'm not going to blame them for a problem that definitely existed in the package management world before them and will continue to exist long after everyone forgets about NPM.

link
SomeCallMeTim 1403 days ago
The default should be shrinkwrap, like `yarn`, with the ability to upgrade packages manually when you decide that it's a good time to upgrade packages. I don't like things changes at all without explicit interaction. Services like Snyk will let me know if there's a specific security concern with a package version I'm relying on.

Which is why I use `yarn`, I guess.

link
krono 1403 days ago
> Don't downplay it's importance and it's disadvantages that came along.

This is rather unfair.

Your previous comment referred to NPM in the broadest possible sense, so what else would you expect its audience to do but to interpret it in the same way?

It is primarily a package manager and so I assumed you didn't like it for how it functions in that capacity.

That is not to say that I disagree with you - it's their priorities and stubbornness on major issues that I myself take issue with, but I'm complaining too much already in general so I'll leave it at that.

link