Hacker News Reader

I am actually pushing our frontend devs to remove more and more dependencies and leverage LLMs to just write the code instead of all the dumbass packages in hellscape of supply chain attacks via node/npm.

View on HN

You are signing up for another hellscape of unmaintainable slop. Enable package cooldowns and only whitelist internal packages and you are better off than 90%

You act like the existing packages being published in this ecosystem aren’t already slop or quickly getting there.

We already do cooldowns and disable preinstall and postinstall scripts on all packages except for ones that actually require it.

I bet if you looked at 70% of your dependencies pulled in, you would be horrified. I would rather have that capabilities via code in my repos at this point.

"Unmaintanable" by who? Vite is on its n-th major revision, yet as a user none of my pain points have been addressed and god-knows-what has been added. If that's "maintenance", I don't want it, because what I need out of Vite is trivially replaced. It's the same for most other dependencies. I need a particularly problem solved, but along with a dependency come the authors who, having solved the problem, continue to invent new problems, because they are emotionally invested in their work. I don't begrudge that, but there is a conflict of interest here.

Reply on news.ycombinator.com