Hacker News Reader

Comment by eric4smith | Hacker News Reader

The worst part about all these node modules is the little small silly ones that do something really inane - like to just get the current year.

I said the same thing about some ruby gems years ago and thankfully that’s a little bit sane now.

I don’t use JS that often. But recently I looked at the dependencies for some library I was using and I was astonished at the literally hundreds of tiny modules that were being used.

And it gets even worse - those tiny little modules have their dependencies too.

Amazing.

View on HN

Someone linked me to 1-liners[0], which is - you guessed it - a bunch of one-liners. I think it's nice to have as a reference. But a dependency? Really?

My least favorite is assign.

Not only does JavaScript feature that natively (though I suppose the library may predate widespread support for Object.assign), the 1-liner assign flips the order of the parameters!

    assign({ a: true }, { a: false }) -> { a: true }
    Object.assign({ a: true }, { a: false }) -> { a: false }

And most of them are just straight-up pointless! Like, let's introduce a dependency for decrement lol

EDIT: In looking up whether the 1-liners assign predated widespread Object.assign support, I found that their implementation - confusingly named extend[1] at first - literally used Object.assign from the very beginning. And they still chose to mess with the parameter order. For shame lol

[0] https://github.com/1-liners/1-liners

[1] https://github.com/1-liners/1-liners/blob/7c1f8d51df4b4b3e0a...

> Like, let's introduce a dependency for decrement lol

Here's a package that basically does that: https://www.npmjs.com/package/number-precision

Not entirely unreasonable as all `number`s are floats by default in JS, but the implementation of the entire package (https://github.com/nefe/number-precision/blob/master/src/ind...) is less than 100 lines of code and actually contains a method called "minus".

The very worst JS packages I've seen have got to be is-odd and is-even. 430,796 and 202,268 downloads every week, I kid you not!

Seems like a perfect candidate for a drive by fix. If you see it in your dependency tree, fix it in the project that uses it.

It would appear this argument order is due to Principle 5: Data comes last, for consistent currying.

You might not like it, or the library (I don't write JS on purpose, so no opinion), but it's right there in the README.

I was not aware of the data-last convention. Thanks! Makes a lot of sense.

My mental model of assign was backwards, and it took me a while to comprehend why their implementation would be data-last.

So, the data is the object that is being modified? And the idea is it lets you write stuff like this more easily:

    const addStuffToObject = stuff -> object -> assign({ "some_stuff": stuff }, object);
    const addWeirdStuff = addStuffToObject("weird stuff");
    const weirdObj = addWeirdStuff({ "foo": "bar" });

Yes, and this sort of application (pun intended) is what the one-liner library is for.

If you have a function isEqualTo(a, b), you can curry(isEqualTo, 5) and filter with it.

`assign` could be used in the same way for assigning/overwriting the same field in an array of Objects, and so on.

It's got 2-3000 installs/week so not many people are using it.

https://www.npmjs.com/package/1-liners

A project I've been working on has roughly 40 dependencies. If you run `npm install` it'll pull about 1050 npm packages.

Change one minor version number and everything breaks. Forget one dependency and npm will not tell you that a dependency is missing but instead it'll complain that Steam has a broken link in the home directory (this is a known open issue for years and the only two solutions are to uninstall Steam or to use a Docker container)

Needless to say I am not a fan of large web projects.

I don't understand why you're getting downvoted. I'm a JS developer (and framework developer) and what you describe is a serious problem. It's great that there's so many problems solved, but some stuff is just a one or two liner that should be in your own app's /lib, not a dependency.

This is one reason I like Deno's idea of having a standard library (I just wish Ryan would have proposed that for Node directly instead of creating a brand new runtime).

The solution to all this dependency mess if for NPM to make a standard library. Yeah that sounds crazy and weird. But they are in the best place to make a unified standard library for Javascript. This would bypass all the junk transitive dependencies and have more libraries rely on a centralised but standard library.

Anyone who's run a CI platform for more than a few devs and NodeJS projects quickly bumps into inode problems unless they thought about build server filesystems in advance. Very quickly you end up with hundreds of thousands of minuscule files filling up the disk.

Imagine how easy it would be to exploit one of those too.

Right - every single dependency adds potentially another human maintainer who, if bribed or threatened, could release an update that exploits your project.

Reply on news.ycombinator.com