Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Well javascript's package management is designed around the micropackage.

It really doesn't bode well for microservices of any large scale complexity, unless there are concentrated meganodes with limited interconnects like cities and superhighways.



I think the micropackage system is great in theory; it just falls down with bloat and security. Security could at least in theory be mitigated by something like pledge. Right now every developer on the (transitive!) deps authors list effectively has full access to our production systems, and that's ridiculous.

Bloat though ... I mean, if every npm module was simply a directory with a package.json file and a couple js files I'd be happy. But thats almost never true, and usually for bad reasons. I'm not sure how to fix the problem. A few years ago I worked with a guy who maintained a popular little 200 line react image component on npm. The project website was great - with example images and whatnot. Some software we worked on used his library. Our node_modules was huge, and one day I took a look to try and figure out why. It turned out his tiny module was bundling all ~10mb of example images in the package itself.

He was shocked and embarrassed when I pointed it out to him. The library had thousands of stars on github at the time. Lots of people were using it but nobody had noticed and mentioned it to him.

10mb isn't that big, but this is the sort of sloppiness that really adds up over time & thousands of transitive dependancies. Would tooling fix the problem? Maybe a little, but I suspect the problem its partially cultural. A lot of the web development community suffers from a lack of ... thoroughness. Like, the expectation is if the website works and looks pretty, you've done a good job. And invisible bugs and issues get overlooked consistently. Like app bundles which silently include multiple copies of the (200k) moment timezone database. Or obvious security issues that web devs just don't know to look for. I suppose this is how juniors learn - but it feels like a very lonely place sometimes when you have skills and experience.


That 10MB anecdote reminds me of someone that deconstructed a massive windows app and found tons of junk images, libraries, and other wasted space.

Meanwhile WinAmp was sooooo tiny.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: