Hacker News Reader

Comment by gitgud | Hacker News Reader

NPM gets a lot of hate for it's dependency managemnet, but I'm not sure what a solution would be to this problem.

- They can't currate packages, or else that friction will drastically slow down the ecosystem (1000's of packages get published everyday).

- They can't remove/disable packages (most of the time), or dependencies will no longer be strictly immutable.

- They can't disable sub-dependencies, or else this would greatly reduce code reuse and increase redundancy and complexity of packages (every package may have to roll there own X, or compile their package dependencies into bundled JS with no dependencies).

I think the problem is simply; it's a low friction dependency management solution -> which made it so popular -> which is making it a target for malicious actors.

View on HN

After 10 years of nodejs I can honestly say I wouldn’t mind the friction. NPM is a wasteland of abandoned packages and reinventing the wheel. They never solved discovery so you have 500x implementations of the exact same thing. Around 2015 we passed the point where looking for the “right” package takes longer than writing your own.

See, .NET get a lot of hate from the open source community, but this reason is one of the big ones of why I prefer it. Even when you compare it to Java, I feel like it's way better in this regard.

If I want to work with JSON, I use Newtonsoft.JSON. If I want an ORM I'll use Dapper (lightweight) or Entity Framework. So many libraries that would you need if you're using Java or JS is just built in to the standard library.

I know it's not a 100% fair comparison, since I am biased. Part of it also might be because .NET is younger and less widely used, but I feel it's pretty true. Though, Python has ton of open source support and is better in this regard.

> I know it's not a 100% fair comparison, since I am biased.

It might also have something to do with you apparently unironically comparing a framework to a programming language.

I'm not sure that you understand what .NET is. .NET is a platform/ecosystem. I was talking about packages. Packages are managed by nuget, which works across all .NET languages, which is why I didn't specify a language.

Framework, platform, ecosystem, SDK, etc: you're rather neatly sidestepping the point that you're comparing not a programming language to programming languages. A fair comparison would be C# to Java, or Javascript.

What Microsoft chooses to call the .NET Standard Libraries is not at all the same thing as a language's standard library.

How is that relevant at all? We're talking about package management. .NET uses nuget. Let's look at the nuget site:

https://www.nuget.org/

> NuGet is the package manager for .NET.

So my point is invalid because I wrote .NET instead of C#/VB/F#? You might want to contact nuget to tell them their site is wrong too then.

My point is that finding quality packages is easier with nuget than the JS or Java package managers. And using them is usually easier too. It's a fair comparison.

.net is both framework and language, for the framework comes with the language.

.NET is not a language at all.

C# is, VB.NET is, F# is. .NET, not as much.

not to mention you can have a middle ground with a curated list and an open repository - think arch user repository

> that friction will drastically slow down the ecosystem

This is a feature.

Reply on news.ycombinator.com