Hacker News Reader

Comment by Mithaldu | Hacker News Reader

Asking for Immutable / Append-only is insanity, due to the fact that eventually someone WILL clutter the hell out of it, which all of your mirrors will hate you for, as well as downstream ecosystem toolchains. The only viable way to allow it is by vetting every upload, and uh, good luck finding volunteers for that.

Decentralized / Distributed is a good thing to have and prior art already exists.

Source: Experience with the grand daddy CPAN.

View on HN

> The only viable way to allow it is by vetting every upload, and uh, good luck finding volunteers for that.

Debian seems to have no problems with that.

Why parrent comment was downvoted?

Major Linux distributions (Fedora/Debian/SuSE/etc.) are excellent example of proper solution for the "dependency hell" problem for C programs. JavaScript is the new C, but for web, so same solution will appear for same problem.

Debian vets the hell out of the developers, but once you're a dev you can update any package. It's a major faux pax to push an update to a package that you're not responsible for without a very good reason, but since they're all signed with the uploader's public keys this isn't a problem.

> Debian seems to have no problems with that.

Because Debian developers do not package all sort of crap.

Yeah, no. This is 90% of the reason why I stopped using Debian based distros. There's a complete lack of consistency with how they do their package management to the point that I eventually started to build most things from source. Too many outdated and unpatched packages.

Archlinux is a bit better, but the crazy amount of timeouts and the everything-goes mentality is getting pretty frustrating.

CentOS/rhel isn't much better, for what it's worth. Dear god, those repos....

Immutability doesn't mean you need to have the whole history locally. For example in git you can just checkout one branch while the whole repo is on the server. For bitcoin there are clients which download only a part of the blockchain even when every transaction is immutable and cryptograpically signed.

It is not insanity. It is actually what many sane package managers do. Allowing someone to "unpublish" something that many depend on - that is insanity.

Vetting new module is what the drupal.org project does, and the backlog is massive and people don't want to submit new projects due to new module hell.

After their first module they can create as many new modules aas they want though.

Worth noting too, that there is a strong community movement AWAY from the thorough vetting process and TOWARDS an unvetted, open system modeled after npm et al.

Maven Central (java) is like that. So far not much problems.

Reply on news.ycombinator.com