Haney Codes

I respectfully disagree. While it's very good to encapsulate functionality, and have stable and well-defined interfaces, there is also a great value to having a unified platform and community that builds interoperable things. Would you rather assemble your project from 250 different libraries, some of which may be incompatible with other ones? Sure, each may solve a tiny problem, and they may all be orthogonal (best case) but there is a major need for a unifying paradigm above all those components so they can all work together. Here is a counterpont to solving tiny problems: http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-progra… Basically, I prefer to have a growing community working on a growing snowball of components that are all interoperable and can be assembled like lego bricks. I think Wikipedia has such a community. RDF has several such a communities. The Web has such a community. This really creates a lot of value by having an exponentially growing platform where many thing works with many other things.

I agree, it may be cliche, but I think the exact same thing whenever I see this kind of practice, too. Or that the developer that has never had to manage a live system with users that know his phone number and his boss's phone number. "Oh, this is just for a test mock up. Nobody is supposed to actually use this to install it for real." Well, to experienced people it makes you look moderately stupid, and to inexperienced people it looks like an elegant solution. It's actively hostile to secure system planning. It reminds me of the NPM left-pad debacle[0] and some of the criticism[1] that came up from that. 0: https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ 1: http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-progra…

http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-progra… is a nice article on the subject of left-pad. If you can't implement a left-pad in less than 5 minutes yourself, you don't know how to code.

> Is there some other way of programming I don't know about? Unfortunately - yes, there is. There is a school of developers who choose to pull in a third-party library even for left-padding a string: http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-progra…

I really liked the message of each generation of programming considers the next "not real programming". It makes me reconsider the pushback against node-esque micro-packages: http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-progra… Maybe this is just the next logical evolution of programming.

http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-progra… TL;DR: Left Pad is a NPM package that was removed by it's author in protest. Apparently, a ton of other packages broke as it was a major dependency across the NPM ecosystem.

If you explicitly requesting a particular version, that mitigates the security concerns to some degree (though as this incident proves, you are still reliant on that version being published for proper functionality). That said, the fact that npm's blog [0] indicates that a republished package (with a new version number) mitigated the issue to some degree, and this comment [1] suggesting that the default behaviour is to get the latest minor release, makes me wonder how widespread of a practice that is in reality. [0] http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm [1] http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-progra…

We disagree on the utility of adding an entire dependency for simple rename of os-homedir. But there are myriad other equally ridiculous packages. is-positive, for instance: https://github.com/kevva/is-positive. Abstractions are good when they hide and generalize complexity. These modules merely conceal mundanity. > Edge cases are often identified and accounted for, even if the responsibility of the package is tiny. In my observation, the opposite is true -- most of these trivial packages punt on edge cases. is-positive makes no attempt to handle any. https://www.npmjs.com/package/average implements an utterly naive calculation of an array's mean that is numerically unstable in the presence of JS's everything-is-a-float semantics. Hiding tiny, naive implementations behind dependency imports actively harms understanding of the implementation details and failure modes of the code being relied on, in addition to making your build much more fragile by encouraging you to rely on external dependencies that can and will vanish from the Internet at inconvenient times. It's a bad trade-off from every angle. Edit: this blog post (currently on the front page!) does a really good job of capturing my utter bafflement at how completely crazy the node community has gone with this nonsense http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-progra… Edit 2: and none of this even touches on the complete insanity that is npm running arbitrary code in each dependency at…