NPM, why am I not surprised... and this broadly applies to the JS ecosystem.
When people delegate their brains to others, their own judgment naturally deteriorates and it makes them much easier to fool.
When people delegate their brains to others, their own judgment naturally deteriorates and it makes them much easier to fool.
A thought as old as thoughts about thoughts are, almost:
> For this invention will produce forgetfulness in the minds of those who learn to use it, because they will not practice their memory. Their trust in writing, produced by external characters which are no part of themselves, will discourage the use of their own memory within them. You have invented an elixir not of memory, but of reminding; and you offer your pupils the appearance of wisdom, not true wisdom, for they will read many things without instruction and will therefore seem to know many things, when they are for the most part ignorant and hard to get along with, since they are not wise, but only appear wise.
The quote above is about books, from Plato's dialogue Phaedrus 14 (370-360 BCE). You by any chance feel the same about books as you feel about reusable JavaScript modules published on npm?
Nothing is black nor white but npm brought its fair share of dumb shit: https://en.m.wikipedia.org/wiki/Npm_left-pad_incident
I mean, it is fairly similar to what parent actually wrote, isn't it a relevant quote in the context? You're not actually arguing for one way or another, but simply because you've seen the quote multiple times before, it doesn't apply, or what are you trying to say?
How is the left_pad incident related to developers becoming easier to fool?
Sure. So too have books. In that instance, does the blame lie on the advent of books, or to the reader too naive to tell the difference?
On the balance, writing has been a net positive. Probably. Plato wasn't wrong; he could (or would) not anticipate the upsides.
If you do not believe that, then might I interest you in uncritically imbibing the succulent nectar of wisdom flowing from the Flat Earth Society?
I’m by no means agreeing with the quote, nor am I against reusing programming libraries carelessly; I just don’t see how the two are related.
I dunno, Linux distros have a pretty good track record at the same problem, over multiple decades of evidence.
The difference is that they don't allow self-publication. Canonical and Red Hat et. al. work downstream of an active community of developers cross-attesting good software. So their problem becomes "This software is known to be good, let's package it!". So to get malware into the machines of users it's not enough to fool the users, you need to fool the packagers too. And it happens, but very rarely (c.f. the xzutils mess from last year).
Node and similar repositories thought they could short-circuit that process, and as has been extensively documented, it doesn't work because users are too lazy to authenticate their own software.
Other than that, I don't think there's a difference. When I write node projects, I tend to minimize dependencies, but I've seen PR comments saying "you know you could just get a package to do that".
Do you have some statistics on that, or do you just feel that way?
Not in anywhere I've worked for the past ~decade...
Just mentioning these because they are trendy.
Regarding the general issue, it can happen in any language with package management.
Its not reasonable to just yell js sucks because I’ve seen it in bunch of places by now.
Because VSCode and npm are popular.
It’s not like Ruby gems are immune to this. They just aren’t as popular.
> it has the same description as the original truffle extension: “Build, debug and deploy smart contracts on EVM-compatible blockchains.”
LLM-ass comment.
What? That simply is not true unless you mean "good" as in "good in spreading malware". lol
Which is a help for spreading both good code and malware.
> the need for caution when installing VS Code extensions, especially those obtained from public package registries like npm.
I'm not aware of any way to install a VS Code extension through NPM. The article honestly just reads like the author knew that Mend does a lot of business selling NPM dependency scanning and that they're therefore expected to stuff it as a keyword for SEO.