Hacker News Reader

Comment by yuchi | Hacker News Reader

Sorry, I’m gonna say it straight: this is bullshits.

A bad behaving dependency (has useless deps) doesn’t invalidates the whole idea of using a package manager.

Probably the author has not enough experience in maintaining projects written by smart people where they write by themselves all the collateral parts.

Using dependencies extends the “standard” library so that it increases global (extra team, oss) reuse and the probabilty to find something “known“ in your next project.

Could be wrong, in that case I’ll stand corrected.

View on HN

That may be true for backend stuff, but not for frontend development. Adding dependencies means that the user is exposed to a lot more.

I am blocking Javascript vigorously allowing the occasional first party script, if I really value the site. If you throw me into a vicious cycle of forcing me to allow more stuff at each cycle, I go away, especially on retail sites.

    If you throw me into a vicious cycle of forcing me to allow
    more stuff at each cycle, I go away, especially on retail sites.

Avoiding dependencies to capture the 0.01% long-tail of users that heavily block JS seems like a massive waste of time for anybody but the most specialized of retailers - especially since those abandoned visits aren't going to show up in anybody's analytics...

People are learning more and more about ad blockers and javascript blockers. The illusion that "you should trade every CPU cycle on your thing for little benefit and amusement" is going to go away, hopefully. The bullshit of front-end dev is pushing the limits of physics these days. Just like CPUs settled around a certain speed and we're witnessing the end of Moore's law, the same will happen with download speeds and bandwidth.

Maybe. But I am trying to convince everyone around me to it. As I am the most reputable person (in that regard) around this usually convinces people. And that compromised machines will be wiped vigorously.

I assume that most people around here are pretty good multipliers.

Modules installed from npm are typically bundled together in a single file with webpack or a similar program, and served only from a first party domain. Stuff included from third party websites is just bad design.

I don’t believe you are representative of a normal user

That's true, but for exactly this reason I am responsible for many machines.

Currently, the best malware protection is to switch Javascript off. Every user understands the consequences of crypto malware. Therefore...

Reply on news.ycombinator.com