Hacker News new | ask | show | jobs
by matheusmoreira 31 days ago
This has nothing to do with standard libraries or popularity. It's about trust.

I signed up for an npm account and pushed packages. Same for PyPI. Same for Ruby gems.

There's no actual reason why anyone should believe I pushed anything but malware in there.
1 comments
stephenr 31 days ago
Did you not read point 3?

Developer experience level is a part of the problem.

link
matheusmoreira 31 days ago
Yes, and it makes no sense. It's not a "swathe of front-end developers" problem.

Developers in general want to push packages. They don't want to experience friction while doing it. They especially don't want to have to do things like engage with Linux distribution maintainers in order to get their packages into official software repositories. They want to just run $pkgr publish on their repo and that's it. So they invariably end up creating their own distribution mechanisms with zero maintainers involved. Just untrusted randoms making accounts and pushing random stuff. It's easy, so naturally what happens is the repositories get filled with software.

It's only natural to use the stuff that is out there, so the packages get added to projects as dependencies despite the fact none of it is even slightly trusted. Developers hate friction when using libraries too. They very much want to just run $pkgr install x on their repositories and be done with it. They don't want to do things like read the source code or verify that it actually corresponds to what they've downloaded. That's somebody else's problem. On Linux distrubutions, that somebody else is the package maintainer, the exact person the programming language package managers aim to eliminate.

link
stephenr 31 days ago
> It's only natural to use the stuff that is out there

Sure, if your entire "community" lives and dies by a nonsensical "don't reinvent the wheel, there is a package for that" chant that would rival the most fervent cult members.

link
matheusmoreira 31 days ago
That is quite literally the most persistent cargo cult in the entire computing industry. It's the rule, not the exception. Pretty much every community is guilty of it.
link
stephenr 31 days ago
Which other community imports a third party package rather than writing `% 2 === 0` (or it's equivalent) code to test if a number is even or not?
link