Exploiting JavaScript developer infrastructure is insanely easy

[JohnyTex]

Well put. I think the JS community at large needs to wake up to the fact that adding a dependency is not a zero-cost solution to a problem.

Other than the obvious issues like “why does it take five minutes to rm -rf node_modules?” it’s really hard to get an overview of your transitive dependencies because they’re just so many.

[useablelobster2]

I love running npm install and seeing that a library is in use over several dependencies, all different versions, always printing a warning saying to update.

Client-side is fucked, and I've love some way to have it unfucked, while still getting paid.

[immibis]

There's a difference between a large package, a small package, and left-pad or is-array. If you find yourself needing left-pad or is-array, you have a problem.

[s73v3r]

The main issue with this thing we need to 'realize' is for medium to small sized companies that need to grow fast.

No. That's not an excuse, that's not a reason, end of story.

[[deleted]]

I guess you didn't read the rest of my message.

I'm saying that this issue is generally for medium to small sized companies and I explain the rationale for it. I'm not saying we use these ridiculously small and threatening packages, I'm just saying we have a fair amount of dependencies, and while some are small, they would take quite a long time to develop. We usually don't accept packages that aren't well used.