Hacker News new | ask | show | jobs
by fire_lake 749 days ago
> have all done a great job building amazing tooling to download and verify resources from the network against a lockfile

This is a bad assumption
2 comments
YuukiRey 749 days ago
If the underlying package eco system is a mess then it’ll also be a mess in Nix. To this day Nix doesn’t really have a good answer to Python or JavaScript packaging.

If the underlying package manager is good (Rust, Go) then there’s just no need to reinvent the wheel.

link
IshKebab 749 days ago
Why? Are you referring to the fact that it's opt-in; you have to use `cargo build --locked` or `npm ci`?
link
bavarianbob 749 days ago
I interpreted the parent to mean that it might not be fair to assume existing package managers have done a _great_ job at downloading and verifying, especially verifying, resources from the network. There are businesses that exist attempting to solve this problem like socket.io. Safely installing the correct dependencies for a project is still not a guarantee from any of the major package managers.
link