Please Stop With MicroLibraries NPM

[@AliAltun]

"A little copying is better than a little dependency." Rob Pike - Go Proverbs

[@albertoarmando6711]

wisdom

[@paulleimer1218]

My hope is LLMs will help convince people not to use microlibraries

[@asd121asd]

nah, they'll do the average thing, which is to add microlibraries all over the place

[@annacurransmotherofmeghanc1841]

My old boss had one of those micro thingy's.... at least thats what his wife told me one time at a Christmas party. I wonder why she shared that with me anyway?

[@DataToTheZero]

Strong Autism Posting: Normal Men: Woman says something tangential related to sex. She must want to have sex. Autistic Men: Woman asks if you want to see her new mattress. Why would I want to see a new mattress, doesn't even sound like it's anything special.

[@Lolimov]

I see what you did there...

[@jwr6796]

You lose

[@bloodline39]

She thought that you share the same problem like your boss

[@Kafuggi]

Micro Packages can cause a lot of strain in relationships

[@macchiato_1881]

This is why I just take code from npm micro libraries and just "borrow" it into my codebase. Most of these stuff are just single file crap that can be "borrowed politely".

[@thekwoka4707]

99% of it is shit anyway, so even borrowing it is too much. Just rewrite it yourself.

[@ruslan_yefimov]

@@thekwoka4707Copying is easier. Unless you wanna change something about it

[@nicholasmaniccia1005]

​@thekwoka4707 I remember being new to programming during that whole leftpad thing. I forgot who said it and it was probably a lot of people but this guy was one of the first, "the problem isn't that leftpad got pulled, it's that so many developers built applications that relied on a external package to do something as trivial as padding a string." I like JavaScript alot, prototypes are better than classes for a whole bunch of reasons. But I hate how other people use it, they are either frankenhackers or programmers who are usually pretty skilled and experienced but not giving JS the time of day and see it as an inconvenience that they try to make look and work like their preferred language.

[@follantic]

Just go to the git repo and copy what you need. It's a great resource. Somebody should write a npm-degit package. Wait.

[@CallousCoder]

Back when I wrote mission critical software for health care, most products that could potentially kill a person, no external libraries (not even libc) were used. Since you also had to prove it to be correct. Which made development slow at times, but also fun because you got to do those lowlevel things.

[@thekwoka4707]

Nothing more fun than an afternoon spent arguing about whether a loop should be manually unrolled.

[@cthecheese]

Are those types of jobs still around, because we should really consider getting back to that.

[@CallousCoder]

@@cthecheese yeah sure, the conservative healthcare, aerospace, energy production (nuclear/gas turbines)

[@cthecheese]

@@CallousCoder thanks!

[@Kane0123]

I can’t be expected to write custom string padding at every company. I’m a backend engineer, not a string engineer.

[@gerkim62]

copy it into your codebase it is literally 5 lines ctrl c ctrl v

[@stefanalecu9532]

You're an useless engineer if you can't write left-pad

[@unformed]

erm its sarcasm

[@RealRatchet]

​@@stefanalecu9532reddit moment

[@winterhell2002]

@@unformed millions of people who download leftpad or is-even arent all trolling. Some really cant or wont write the code

[@pl4gueis]

Prime: "Flip you are gonna have a hard time editing this" Flip: "No problem. I just leave it all in anyway"

[@Jarikraider]

I don't get why Prime is bashing regex. CrowdStrike uses regex, so obviously it is professional grade.

[@omkargurme20]

Don't forget cloudflare as well

[@mattymattffs]

Regex is fucking awesome. It's very simple overall. People just try and use it for too much.

[@voskresenie-]

The problem with regex is that there are a thousand different variants, and the base standard isn't powerful enough so you basically have to use a program's variants, but they won't carry over to a different program. Even with the basic features, there are many different ways of escaping. Vim has support for 4 different regex escape formats. Seriously. It's a mess. But if there were a powerful variant that had broad, if not universal, adoption, it'd be incredible.

[@alanscodelog]

Omg, the ansi color thing. I literally just saved 6-7 consts for the escape codes for common colors to my utils library and I don't think I ever needed the colors library again.

[@follantic]

Sindre Sørhus is trustworthy. Use chalk instead. For other small packages I've gotten into the habit of being skeptical and copying or reimplementing. I'd rather copy some code off of GH than hane a dependency with 200 downloads a month.

[@LewisMoten]

Ditto. I also added the ability to nest colored text within colored text, so the color prior to the injected text was restored, and the reset tag wasn’t added if it wasn’t necessary.

[@matt_milack]

Your video on sysadmins, network admins, Linux, or Bash would make my day!

[@JoeStuffzAlt]

I remember npm before they fixed the directory nightmare on Windows. "Screw Windows users for npm having more than 255 folder paths due to node_modules dependencies". Where I stood on that is "okay, if there's a bug in that directory nightmare, how in the hell can I find it?"

[@cyotaffer2180]

This is also a huge problem in Cargo. Recently debian said that Rust programs are unmaintainable for stable releases because they have way too many micro-dependencies.

[@RomanAvdeevX]

That's why Rust is statically linked

[@happygofishing]

​@@RomanAvdeevXrust ABI skill issue

[@dealloc]

I've maintained many services written in Rust at scale, and haven't really seen this being a huge problem compared to NPM. Mostly because when you search for packages on cratesio or librs, the list usually contains the most related and top used crates. Not saying it doesn't exist, I am sure it does, but you really have to seek it, and even then it's quite easy to dig into the source from the docs to see under the hood before you pull it. Compare this to NPM, which doesn't make this as nice and trivial. I am also curious what they consider "micro-dependencies", because some crates compile to the same things but provides a some abstractions and DX (like thiserror, binrw/deku, nom, itertools, etc.), which you _technically_ could implement on your own, but is more than likely not to; especially if integrating with other crates that also provide these as features, which you can easily interop with.

[@cyotaffer2180]

@@dealloc I am not 100% sure but I think that they have to support the exact version that they ship so they have to vet every single dependency in the project and they also have to write patches if something doesn't work for some architecture etc. They would rather have 10 or so libraries at most for a large project. As an example I saw that there were several crates that were crypto related for firefox and they wanted 1 standard crypto library for everything related to crypto in rust with good versioning, so there is no need to look at 20 different libraries. Also there could be multiple versions of libraries in a single project due to some other dependencies.

[@lever1209]

we need Maven style repositories for rust and cargo, easy to use central repositories are just breeding ground for all the worst kinds of software

[@baxterdevin]

"Maybe compile errors were the friends we made along the way." How DARE you, Prime! Take that back!

[@AwesomeArgonanth]

My question is, why do people even use these in the first place? The only time I even go look for a library for something is when that something would take a ton of time to figure out or do myself.

[@danser_theplayer01]

Suggestion: you should write trivial generalised helper functions in one little .js file and import is as a dependancy from yourself, just copy paste the file into your project, imort it where needed, and list it as part of the compilation process or whatever you're doing. Basically have your internal/personal/prprietary "package" to import helper functions.

[@Lord_zeel]

Re: GDPR and package managers. I would hope that the license provided on the package would essentially supersede GDPR. Though I also feel like there is a massive difference between giving a company some PII, and publishing something that contains PII. Like, can an author unpublish a book because it has their name on it? That would be pretty silly. So I would bet that packages don't count, since they are something you are actively publishing in a public way, making the giving out of PII explicitly something YOU are choosing to do. But even if that's not the case, I would think anything you attached an irrevocable license to wouldn't count anymore. If your name is part of the code that you have licensed, you can't just take it back.

[@Exilum]

23:13 Flip took it out but we skipped so much of the article 😭

[@GrassXMagnum]

My biggest bottleneck is listening to my IDE suggesting changes in code that hasn't been touched in years. It's very distracting and so satisfying. Then I need to stash it all and actually focus on my feature

[@StingSting844]

We've been doing this at work on a small scale. First we build out features, then after sometime we move the most stable dependencies into our own repo. We vet all our dependencies and the biggest fight is with frontend folks who don't understand the risk. We are in cyber security space and deal with multiple US govt agencies as clients

[@Drezden79]

I just had to do this on a new API client. The old one wasn't updated for six years and had tons of random dependencies. Got it down to three. Went from 50 vulnerabilities to 0.

[@Merssedes]

"Afraif that they won'y be able to understand how things work" -- this is my main reason to NOT use libraries :)

[@vaolin1703]

This is why I have a hard time getting into vim since it seems like every tutorial immediately goes to installing packer and I don’t want to use something I don’t understand.

[@bitwise-dev]

34:12 this is very true, I always get this sentiment from colleagues that they think I am very very smart. What they don't understand is all I did was to learn of things in a very unhealthy amount of time outside work hour like working on my own projects.

[@drooplug]

Writing your thoughts down whether it's in pictures or code, reduces your mental load. You no longer have to keep track of all those things in your head while working. Starting from a simple program and move it towards a complex one is iteration. This is how progress is made. It's a great way to break down work into managable steps. You don't climb Mt. Everest on your first day of Mountain climbing.

[@ErazerPT]

Yeah, too many people include stuff that is too small to not have been written by themselves. As for drawing... while i like whiteboards and UML, i mostly find it useful if I'm throwing around ideas as "black boxes" and I'm not sure how many there are or how they will connect. That and working on things where there's a "spatial relationship" of sorts. It's more of a "ordering modules" than a "what this does" thing.

[@testtest-qm7cj]

It is interesting to see that JS and Rust people are realizing that they need to move away from micro-libraries, which are the inevitable consequences of easy to use package managers like npm and cargo, while so many people on r/cpp complain about the current state of C++ package management and demand the C++ standard committee to focus more on the language tooling and to provide something similar to npm & cargo. I wonder what would be the better middle ground for both extremes?

[@deathsride1818]

I have this conversation with coworkers all the time. Regardless what you think about Microsoft and C#, this is why the official c# nuget packages are so good.

[@FathDaniel]

What? Nuget suffers from it, same way Rust does. I guess maybe no one uses C#, so no libraries.

[@deathsride1818]

@@FathDaniel you can do it. Read it one more time. “Official” nuget packages. Look I even gave you a hint.

[@joshuaworman4022]

"the only difference between me and you is I'm a workaholic"

[@l3lackoutsMedia]

I think many things would be fixed, if libraries were just ment to be mirrored locally in a local repo, so that the internet going down or a change in a library (malicious or not) does not affect any build process at all unless you decide to sync your local repo to this new version.

[@Evilanious]

In c++ we have the concept of a header only library which means "just copy it" is the intended package management.

[@sakurajin_noa]

However those come with their own set of problems. Many are way too large to be a header only library and would benefit from being split in a header and source file. Others like to cause linker problems because they are included in two compile units. Header only libraries also don't solve the micro Dependency issue. You can have a one line header only library and it is just as bad if not even worse than downloading a micro library. That being said due to the shit that is C++ package management, way more code is written from scratch rather than being included.

[@replikvltyoutube3727]

Came from C originally

[@cthecheese]

@@sakurajin_noathey are essentially micro libraries where you risk duplicating its code all throughout your code base rather than just referencing it. As you are saying, both have their nightmare properties indeed.

[@rumplstiltztinkerstein]

I was doing some fancy shenanigans with a rust crate for encryption and found that there was a bug that happened when the library was compiled for webassembly. Basically it ran in an infinite loop when I ran some of the encryption functions. To find the source of the bug, I started to make it log the value of the variables during each of the loop steps when I ran that function. Eventually I got to the part where it was logging the same variable value in an infinite loop. What caused the bug was combination of two decisions, doing a manual loop with a "while" and a "break" statement for when a condition was true, and using the "#inline" macro. Somehow, in that specific implementation, when compiled as webassembly, caused the compiler to think that the condition variable was a constant when inlining the function. The optimizer would then incorrectly remove the code that would increment that counter, causing the infinite loop. A bug that only happens when compiled to wasm32-unknown-unknown. My solution was simply to change the "#[inline]" to "#[inline(never)]". Such a convoluted bug right? I had to make changes to the dependencies of that crate, manually git clone them, change the source from "crates.io" to my local package, then test the changes, which had to be done manually by starting a server with the website loading the wasm file and running it. If the project had dozens or hundreds of little dependencies doing small things, I wouldn't have been able to find such a bug. Lets keep dependencies to a minimum. Extra: for some extra detail. The "inline" macro in Rust suggests the compiler to pick the code that is inside a function, and put that code replacing where the function was called. This can help reduce the output compiled code. Using "inline(never)", means telling the compiler to never inline the function no matter what.

[@freezingcicada6852]

Micro-libraries make it hard to learn; Sometimes I just skim through Github repos to see how other people tackle something. But some stuff like rust cargo, include or directory maze to try to find wtf it did is annoying. Sometimes you dont even know without you getting the same package managers F it, its so BS. Its easier to get blasted on a code review or w/e soy just writing it yourself. No F-ing WAY they'd bother looking at the dependencies and just 👍looks good👍

[@michaelbuckers]

16:00 I remember that one belarussian website that was collecting evidence against russians, and the dev of some package added a script that nukes the entire computer it google detects its IP as russian. Several terabytes of painstakingly collected data, gone, from every server at once.

[@Daniel_Zhu_a6f]

"Belorussian website collecting evidence against Russians" doesn't sound like a real thing. what kind of evidence was it collecting?

[@johnyewtube2286]

Empty bottles of vodka

[@michaelbuckers]

@@Daniel_Zhu_a6f It was related to this "make love not war" text file created by obfuscated backdoor which was annoying but merely that. Then the author went full psycho and added "rm -rf *" to it.

[@michaelbuckers]

@@Daniel_Zhu_a6f How would I know? I learned about it when someone messaged me about it, it was already done, and there was HUGE storm at their github page about it. The author decided to convert his package into a trojan to display an annoying message based on google api geolocation. But then he went full psycho and added rm -rf / to it.

[@the_mastermage]

@@Daniel_Zhu_a6f Why would it not? There is a fuckton of Belarussians who fled from Belarus that realy hate the Russians to the bones. In fact some of them are good friends of mine.

[@nurglina]

01:02 I remember the first time I saw the String Cheese Incident. It was in 2004 in Ann Arbor, MI at the Hill Auditorium. Good times. Good memories.

[@excitedbox5705]

Or you could go the PHP route and have a proper standard library and not need a huge ecosystem of functions. Things almost every dev needs should be included to avoid duplication and promote SAFE, PERFORMANT, ERROR FREE, code. I would go as far as putting anything in most frameworks into the standard, which is kind of what the big SDKs do. It allows the entire community to work on making the best code possible for what is essentially 99.99% the same. ie. networking, DB, I/O, text, UI, image editing, caching, email, rendering, etc. is all the same, so include it from the start.

[@FathDaniel]

First huge std isn't always a good thing. Another problem is every dev needs something else. You might not need Internet access, but I do. You need support for embedded, I don't, etc. Also std is de jure standard, other libs might become de facto standard. So no one uses std JSON, instead they use simd_json. They don't use std XML, they use jackarta XML. So you might have to support a lame duck library. A library that is unused but that still takes development time away from language maintainers.

[@nickfarley2268]

Well php does not go that route because due to backwards compatibility unsafe unperformant api are keep around. Dead batteries are the cost of a batteries included standard library.

[@thekwoka4707]

There is very little such things missing from JS nowadays. There is also a lot to be said for the std only being core primitives, or incorporating only well defined userland standards.

[@FINALLYQQQQAVAILABLE]

I studied CS in university some twenty years ago and I was slightly disappointed that the first course of programming had virtually nothing than some string manipulation and such. (At that point I had over 10 years of hobbyist programming experience already, including some 3d graphics in assembly and what not.) Now I kind of understand how valuable all that simple string manipulation can be in this god forbidden industry.

[@MarcelRiegler]

I think all of these articles about micro libraries lack an analysis of THE root cause for micro libraries: A lackluster standard library. That's what started all this. JS in the browser basically had no standard library. What is a standard library but a collection of micro libraries? It's entirely rational that people didn't want to recreate or maintain an ENTIRE SELF MADE standard library for every little website with fancy buttons. Many of these web developers went on to other languages, but sort of kept their way of thinking from JS. So they'd reach for micro libraries, instead of checking standard libraries for things that do what they need. If you think that the web devs doing that are just obviously bad developers, I BEG you to honestly ask yourself: If you needed to create the 10th fancy business website on a strict deadline, and needed to support a few different browsers, would you really recreate ALMOST ALL standard library functions you're used to in "good" languages?

[@Daniel_Zhu_a6f]

about quality of 3rd party libraries: about a year ago needed to do cosinor (generalized linear model), but the only python package i found for that was about 2k lines, and it was insanely bad. the inputs were data frames, the outputs were dataframes, functions were printing some math gibberish when running, and of course there were no type annotations or docs. crazy what kind of packages people put out there. my implementation took ~ 200 lines and 3-4 hours, but i've wasted an equal amount of time on trying to make that library work.

[@l3lackoutsMedia]

Labelling things learned in some kind of personal code base is my favorite way of really understanding it over time.

[@oussama7132]

It feels like js has too many libraries, C/C++ have no universal package manager and it seems even devs don't want to have one, then there's C# and Java, I haven't heard of problems with these languages' package managers

[@MrDarkoiV]

Universal package manager is bad idea imho. It promotes microlibraries mentioned in video. What would greatly help is universal package definition. IMHO Go did it best. Just point to website where package is located and it can be imported. CMake is good too, though it has unfortunare syntax and lack of any decent resources for newbies, so it has unreasonably high skills floor for what it is.

[@oussama7132]

@@MrDarkoiV if you're installing microlibraries I don't think it's the fault of the package manager

[@MrDarkoiV]

@oussama7132 Fault is a big word. However, it being default makes microlibraries too convenient to ignore.

[@oussama7132]

@@MrDarkoiV I still don't understand why would someone use a is even instead of using mod or something. If it was something more complicated I would understand

[@sakamocat]

IKR!! if you really need a library, you have to go through the hassle of importing the .so file and the includes, which makes you question the necessity of it in the process

[@sovietspacekitty]

That ending of the article really is lovely. i concurr.

[@pokefreak2112]

js ecosystem is inherently cursed. I recently made a plugin that does some preprocessor magic. The code takes maybe 500 lines to implement, but to make it compatible with all the bespoke syntax of js frameworks and all the different build tools you quickly end up with an enormous dependency count and thousands of lines of code. And then you can choose to either ship the entire package as a monolith and bloat node_modules, or split it into several smaller interdependent packages and make things more complex and fragile in the process. Both options are bad, the only solution is going back to no-build js but that's realistically never going to happen.

[@dealloc]

That one should be solved by building a core abstract implementation which can be reused across interop packages for each tool you want to support. This is really not unique to JS, but an architectural problem with any project where you try to cram every possible support in the same project without considering the separation of them. Or if you're lazy, you could literally just stick with one low-level parser, like Babel, and be done with it.

[@zombiefacesupreme]

Or you could just release it as an esm package which requires no boilerplate whatsoever.

[@pokefreak2112]

@@dealloc I already do that, unfortunately Babel is just one of many compilers I need to support. Babel can parse jsx and tsx but it doesn't do HTML or Vue Sfc's for example. We're kind of in a post-babel era where everyone is writing custom compilers in js or depending on native executables for the heavy lifting, which makes it a lot harder to do the kind of things I'm trying to do. (minimal, Cross-framework AST transforms with source mappings and typescript support)

[@dealloc]

@@pokefreak2112 Babel won't go anywhere in a while, so it's the safest in terms of adoption and lifetime. You _could_ add support for others, but I don't see why that would be necessary. As for supporting other languages, that's different in any case anyway. You decide you want to do some preprocessing on other source formats, then that comes with additional costs. Though, depending on what you're trying to do, I'd stick with the lowest level; disregard the bundler, and only care about the sources it provides through a slim plugin that feeds that into your preprocessor.

[@dus10dnd]

I kept thinking you were talking about Cheddar Bob, from 8-Mile… the first movie from the MCU.

[@helidrones]

The left-pad incident 😂😂😂

[@LewisMoten]

ANSI codes were pretty cool with BBS’s streaming menus, login screens, and animations. I wrote a little helper utility to color my console, but I think most people use color utils.

[@icemantc6]

"you don't even need to be smart" 😂

[@Anubis1101]

One of my first projects in C++ was a terminal-based CRPG, and yea ANSI codes are extremely easy to learn. I think more people should have projects like this early in their programming journey. The hard part was getting the terminal to play along. Windows does enjoy being Windows, and figuring out what works and what doesn't (and thus would need a workaround) was nontrivial.

[@valseedian]

color in the console is so easy in c++.... made a first principles chat client and server back in 2007 in pure ansi console bs. ended up writing an output parser class and macro overwriting cout to avoid major refactoring when I added rich and colored text.

[@unusedTV]

Split is probably among to top 3 most used functions in Advent of Code for input transformations.

[@PieJee1]

The issues with packages also depend on which language you are working in. Javascript with npm: atrocious. PHP + Composer: some small nitpicks, but very stable. Then again with php you sometimes you have to think of which PHP extensions you need.

[@Reichstaubenminister]

Love the T2 shoutout at the end.

[@chonchjohnch]

When accounting for saving development time, it’s worth realizing that having an external dependency adds a sort of latency for people checking what a function or constant is when reading through code

[@keyboard_g]

Regarding LeftPad, why don’t people pull in and distribute the packages that they depend on? You deliver a product, be responsible for it.

[@TangoFoxtrotWhiskey]

I love that conclusion: "You are better than you thiink."

[@maxoumimaro]

One valuable skill for SWE is writing datastructures and algorithms. That's why every cs 101 is putting you through a datastructure course. It's not just for culture or knowing basic datastructures but for you to feel confortable implementing some of them if you ever need to. One day you might need to write an optimized hashmap/graph/vector/tree for your use case, that's why you need to know how it works.

[@edmundas919]

Not a problem for C++, since linking 3rd party libraries takes more effort, than writing them yourself.

[@n1coc4cola]

What I learned is that when you have an issue with your largely used NPM package like left-pad: Remove all previous versions, then make your package bugs version by version and continue to remove older versions...

[@JonathanFraser-i7h]

libraries often have gone through the effort of working out a good abstraction which might not be obvious from the get go. This may be "less development time", but its also possible you'd never have come up with that abstraction because you just don't have the time and experience.

[@zeocamo]

23:46 this with the Sum function, is why we should never ever ever use languages with namespaces, if you can't import you stuff as a named thing so you can follow it all the way back, you should not use the language, like c# you can shadowing of stuff, if they got the same name/parameters you can build it and it pick the first one and build it again and it is the other one. Namespaces is for making bugs you can't see and use a lot of time on.

[@Karurosagu]

16:18 Can't wait to see this kind of rug pull some day

[@almicc]

Right now I work for a company that seriously overuses libraries. It's mostly server-side code that runs on whatever machine we want on whatever version of node we want, and yet it's continuously littered daily with `_.get(this, 'property', myDefault)` and `_.filter(list, 'booleanProperty')` and I'm not exaggerating in the slightest. I take every opportunity I have to remove lodash from files, and I can only assume the people who keep writing it have no clue how to write if statements or use the various null coalescing features of javascript. More than 99% of the time it's a 1 line change and makes it shorter to write and easier to lint, and the other 1% it literally ends up catching bugs because someone typo'd the string or didn't understand what the function they used was doing and the entire line could just be deleted.

[@midori_the_eldritch]

There is a minimum quality for something to be popular, but not to be published. Popular actually needs to work, and often uses better marketing and user friendly interactions. So it does mark a floor of quality, but thats about it

[@davejohncole]

I have been programming professionally since I finished my comp.sci. degree in 1983. My approach to writing code is to just get your thoughts into syntax. Look at what you have done and think about how you could better express it. Iterate with your own code to explore ways to structure your solution. You will almost never get the structure right first time. Our brains are just too shit to do that.

[@theferaltaint5065]

I’ve recently come back to programming, and my current project is a powershell command line interface. I’ve written all of my own ansi color, style, and formatting code. And I was so far behind I might as have been a beginner again. No it isn’t hard. Plus, I typically hate many of the naming conventions a lot of dependencies in node, python, etc. choose for variables, functions, classes, etc. I prefer to just write it myself. Especially if it’s something that isn’t incredibly complex. You learn more that way, and you can truly customize things to be the way you want. I guess people don’t realize you can modularize your OWN code and reuse it. You don’t have to rely on dependencies. But that’s coming from a solo person like me. That becomes more of an issue I guess in very large teams. That said, I’m not entirely convinced having a 100 person dev team working on a project is always the “best” way, though it may be the more productive way.

[@olafbaeyens8955]

Next, the letter A in a micropackage, the letter B in a micropackage, the letter C in a micropackage, and so on.

[@kamertonaudiophileplayer847]

I do not use Cargo for the reason. BTW why does nobody write an article about - I started using one micro library, it worked well, and then the author of the library started adding more and more code in the library transferring it to a huge library. I stopped getting its updates. But some functionality I used from beginning got important updates. I needed these updates. My options 1. get the entire useless for me library, 2. manually incorporate the changes in the initial version I use. I ended with option 2. But I do not know if I did right. I need an article about.

[@gwaptiva]

GDPR does allow you to demand that your personal details are removed (with restrictions -- you cannot demand your tax records be deleted, for instance), but there is also an exclusion on the grounds of "technically required". I don't think anyone has tested the scenario you describe in a court of law at the time of recording, so it's hard to say where "technically required" ends...

[@k98killer]

Babel is a transpiler that transitioned into a compiler, hence it is a transcompiler.

[@sneed1208]

What broke at 36:28?

[@nuvotion-live]

What if instead of “random peoples packages on the internet” you still share micropackages across your projects but they’re your own packages self hosted on verdaccio?

[@bloody_albatross]

The GPL thing doesn't just apply for copy pasted code, it also applies if you just use the library. LGPL is different.

[@bkucenski]

The first time I ran into issues with JS and data types I got very strict with my data types which has been very valuable in my career. Then there are other people who run into JS's fluid handling of datatypes and just try to make more accommodations for their inability to do things properly. PHP is the same way. Up until about PHP 8 you could be very sloppy. If you spent your entire career being sloppy, PHP 8 is a nightmare. If you wrote your code correctly prior to PHP 8, PHP 8 won't start throwing errors at you.

[@RandomGeometryDashStuff]

22:17 looking at source code of is-number, it also tests for number-like strings like isNumber("0o123") is true, so benefit list not correct

[@killcode6717]

A trans-compiler is an interpreter that identifies as a compiler.

[@tttm99]

A *library* only makes sense to me as more than one book. 😂

[@demolazer]

I don't understand why a lot of things aren't built into the language itself.

[@ChannelSho]

The problem with these stupid little packages is I have to trust someone who makes functionality I do need and can't spend the time making didn't also use it. I have an NPM project that has 28 dependencies (which I'm sure I can prune a few), but it blows up into needing ~630 packages. Why.

[@mickduprez9598]

I think I might make it a rule that if I use a library I will wrap it into my own api, this way I can change it out or write the implementation myself once the POC is done. I guess it sounds like common sense, particularly with db engines and such, but who actually does this for general lib code? (as a rule that is)

[@InventorOfYouTube]

You can just download the library one time and lock it in to the version you need. People are too addicted to having the latest versions of minor things. If it is a micro library, it's something you can bake and forget.

[@cheaterman49]

3:23 Such a missed opportunity. It's the Micro Package Problem, so Micro PP. EDIT: 3:50 : I belong in chat with the other degenerates of my kind. :-)

[@Luclecool123]

We just version lock micro-packages and it works fine haha ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯

[@przemekkobel4874]

Well, 'empty' angular/ionic project has over 500 MB, 44 THOUSAND files, and most of these sit inside node_modules directory. Not to mention tons of critical security warnings you see when running npm (and apparently you suppose to just ignore them because this combo is a non-standard use case of node, but no one tells you that upfront so you are wasting hours trying to fix these 'non-issues' and get different messages after each update). This is beyond ridiculous.

[@rogersmith258]

I bombed my first and only programming interview. Just wanted to vent a little. I realize I need to practice more.

[@Karurosagu]

I've never seen this "micro dependency" issue, other than the famous left-pad (which I never used before I only heard if it). I guess it's because I build my own sh1t first with what I have in hand

[@wchen2340]

I'd say "You can get updates..." is a borderline malicious argument. I want to believe.

[@SeanCassiere]

Is this still a problem anymore? Whilst the article was well written, it basically just rehashed everything we already jotted down after the left-pad incident. Those that are going to install these util libs are going to continue to do so and the rest of us have learned. Pretty much every year someone rehashes these same learning from 8 years ago and writes an article on it.

[@BenVisness]

Yep, the article was inspired by actual recent conversations, and various people are still putting tons of tiny packages on npm and getting tons of downloads.

[@i.c.wiener2750]

Took me over a week to set up my new laptop for work, because npm is hell.

[@torphedo6286]

ANSI escape codes my beloved

[@marxizalias3193]

My favourite thing about this is the malicious compliance energy it brings on such a massive scale. As we know, a worker goes maliciously compliant, it can really hurt your business... Machines.. always maliciously compliant. You change a name, the machine is like that worn out worker who is like... business decision, fine, sure, let's change it... see what happens... just asks you if you are sure once and then says nothing as the world around you collapses in on itself like a black hole swallowing all the light until all that is left is the crushed spirits of the person who pressed okay... Oh things are fine? What do you mean third parties are all going offline? Roh-oh

[@kkiimm009]

Copilot and similar tools should hopefully remove those microlibraries. They should be more than capable to write the code in most micro libraries like left-pad for you faster than you can include the library in your project.

[@XiagraBalls]

isNumber: last release 2018; weekly downloads: 74m!

[@X39]

38:00 It is funny, because right now i am in a situation where i have to literally draw things out, as i attempt to create some DB model for a node editor that has customizable nodes Literally having one "node" table, a "node definition" table and some sub stuff that then tells how the node is supposed to look and work (eg. manual interactions, conditions, fully automatic forwarding for simple branching, halting, ...) normally, i code theese things out ... here tho, i have to actually make things in a way that work in a graphical editor

[@JustPlayerDE]

meanwhile ljharb adding 16MB of his own stuff to traverse in a single update adding 66 packages and taking 2 seconds to npm install, causing about 25 Terabytes of traffic per week with npm installs alone. at least it supports node 0.4 now i guess. (15MB * ~1.6 million downloads last week)

[@WinterHawke]

NaN is typeof Number. The correct code would have at least three checks: is it typeof Number, is it not NaN, is it Finite. Still not worth a package but js is stupid so most of these simple packages actually do more than it looks like on the tin.

[@alfonsocano574]

And is it ok for non trivial scenarios? So if that happens for that it could take days, weeks, months… we’re doomed (? .

[@NeoKailthas]

The issue is that these micro packages are part of other packages you don't even know about

[@FreeCodeArena]

Maybe some shadcn for npm packages? Packages with just a few lines of code or simple enough implementations can just be copy pasted 🙃

[@szirsp]

13:40 3rd party code is risky, "the more complex the library" ... more mistakes... "large footprint" That would be an argument for micro libraries and not against them. That's an argument against large libraries, frameworks. I think most of these arguments are against npm package management and not against micro libraries. You could just download the (micro) libraries into your workspace and commit them into your source code repo (including their licenses and maybe an update script). No more silent supply chain attacks (you would need to manually update, download, overwrite, then review and commit changes). Everyone loves jquery until your 1 kB webpage loads 100kB unnecessary javascript. Sometimes micro is better. (Though it might be easier to start developing using an all in one library or framework.)

[@beansbeans96]

also for beginners it will help avoid the problem of getting an error on line 365, (its in a dependency but beginners tend to not realize) when your code is only 20 lines xd

[@urbaniv]

I still believe there are many small utility libraries which are meant to reused by the dev themselve but since private npm packages cost money they just publish one

[@trombecher]

Hate how he consistently selects sentences of text while missing the first and last character. Love u Primagen tho

[@FightStreeting]

It's engagement bait (proven works, as seen here)

[@grencez]

congrats on the engagement🎉🎉

[@anotherelvis]

So how about a single library that contains all the other micro-libraries?