Hacker News new | ask | show | jobs
by mablopoule 580 days ago
> Surely we can agree that distributing shared libraries via a package manager is a good practice, no?

At one point, long ago, you could just download a file, reference it in your index.html, and use it without ever having to worry about updating this package. It had its flaws, but it also had many advantages compared to having an external dependency that might conflict with your version of Typescript, or being highjacked by bad actors.

I don't diss the concept of package managers at all, but there are lots of case where vendoring an external package is preferable than adding it as a dependency.