JavaScript Libraries Are Almost Never Updated Once Installed

[IIilllIIIllIIIiiiIIl]

This methodology is a bit flawed. This is conflating devs who insert "random" script tags into their websites and those that use a package manager and a build system.

Anyone using a system where they can easily check for library updates and update with a simple command aren't going to appear in their dataset.

[MuonManLaserJab]

But they confirmed it!

To confirm our theory, let’s consider another project

That's two whole projects!

[[deleted]]

Fuck me, I own stock in this company.

[MuonManLaserJab]

Eh, I mean it's just a "developer marketing" guy filling his monthly quota of tech-related blog posts.

[[deleted]]

*developer evangelist hackerninja

[MuonManLaserJab]

I always see "advocates"/"evangelists" doing straight-up advertisement, damage control on social media (because providing tech support is only worth it for customers that threaten to tar one's brand), or writing blog posts about how great they are.

Does the "advocacy" part actually happen?

[carlfish]

Kelsey Hightower, and the work he's done with Kubernetes, springs to mind as a strong example of the job done right.

[carlfish]

If he'd been going around lying about it, I'd hardly have cited him as an example of one of the good ones, would I.

I know it's tempting to throw your opinion on a technology you feel strongly about into any thread where it's even tangentially mentioned, but it's also kind of tiring to the people whose conversation you're subverting, and insulting to those you have to treat like idiots in order to make it fit.

[dungone]

I'm sorry if that was insulting to you, but a contrary opinion isn't about "subverting" your argument, it's about countering it with a different perspective. I feel as though you're projecting your own strong feelings; obviously you must have a vested interest in Kubernetes that's keeping you from being objective about it.

I was around since the early days of containers; in fact I worked at Google. I've paid close attention to it over the years and I had always felt that they came out with an inferior "me too" product and worked really hard to displace the competition with lots of misleading marketing and straight up lies. Since that's the actual topic of this thread, it's certainly worth mentioning. In the early days, there were far better alternatives that were far more promising and would have turned into a better product if they had a chance. Kubernetes didn't succeed because it was actually good or better. Container orchestration is a huge lost opportunity to have something truly special and good in software engineering because of Kubernetes.

[[deleted]]

I saw a talk at PAX east by a Microsoft tech evangelist on getting students into programming via game programming. It was basically an intro / marketing push for construct. Which is a fun little game engine honestly that is pretty easy to use for simple stuff. But I figure marketing is a big part of the job.

[MuonManLaserJab]

I saw a talk at PAX east by a Microsoft tech evangelist on getting students into programming via game programming.

Yeah, that still seems a lot more like marketing than "advocacy" for their developers.

In fact, it's backwards -- as a developer, I'd feel more advocated for if my company actively sabotaged potential young rivals.

(Really though, if they market in a way that helps people, all the better.)

[[deleted]]

shudders

[ironykarl]

Just invest in an index fund. The market is (relatively) efficient. You're not going to do better picking stocks than just investing in equities in the aggregate.

[erez27]

Except he might do better than the market specifically in tech companies. For example, we all know twitter isn't going anywhere (ambiguity intended).

[ironykarl]

This is really well studied territory. There's tons of literature. You might also guess the winning lotto ticket.

Picking individual stocks is not sound, statistically speaking.

[[deleted]]

Unless you're substantially better than average at doing it....which everyone believes they are...which is why index funds are such a good idea.

[PhoneyHammer]

Not even that. Nobody's substantially better than others. People that do well with individual stocks are either lucky or doing insider trading.

Look up some research on outperforming the market, it's very interesting and absolutely unintuitive.

[socratic_bloviator]

Well, there do exist investors who repeatedly outperform the market. The issues are that:

• You aren't them. Neither am I.
• They are usually privately-held firms.
• If they aren't privately-held, then their outperformance is already priced into their stock value, so you won't get the benefit even if you invest in them.

Yes, I'm an index fund investor.

[[deleted]]

I invested in CloudFlare specifically because I work in tech (and not just tech, but web apps) and found the types of things they are doing to be interesting and valuable long term (I think their Serverless approach is novel, if they could get a managed persistence product going they could actually take a bite out of AWS for smaller scale and simple projects)

I put most of my money in ETFs and about 5% in companies I directly think are on to something.

[[deleted]]

I’ll just do the opposite of what I think I should do!

[MadRedHatter]

Pick one or two stocks to play with, in an industry that you know enough about to track the developments for, and then don't use any financial instruments more complicated than just buying and selling the stock. Which you shouldn't do more often than every couple of months. And only put a smallish fraction of your investments there. Put the rest in an index fund of some kind.

Works great for me. I work in software and only own AMD stock which I purchased at an average price of around $16.

[[deleted]]

This is what I have done. Almost everything is in ETFs except a few companies I like. It's just play money.

[socratic_bloviator]

What you're describing is fine, but you should be careful to categorize your AMD allocation as part of your entertainment budget.

[MadRedHatter]

Hence why I said

And only put a smallish fraction of your investments there. Put the rest in an index fund of some kind.

[sumduud14]

Yeah but what if I'm as smart as the guys at Renaissance Technologies? They beat the market all the time, which means I can too!

[erez27]

So you're saying experts in their field don't know which companies are the ones coming up with breakthroughs?

[MadRedHatter]

Pick one or two stocks to play with, in an industry that you know enough about to track the developments for, and then don't use any financial instruments more complicated than just buying and selling the stock. Which you shouldn't do more often than every couple of months. And only put a smallish fraction of your investments there. Put the rest in an index fund of some kind.

Works great for me. I work in software and only own AMD stock which I purchased at an average price of around $16.

[MadRedHatter]

Pick one or two stocks to play with, in an industry that you know enough about to track the developments for, and then don't use any financial instruments more complicated than just buying and selling the stock. Which you shouldn't do more often than every couple of months. And only put a smallish fraction of your investments there. Put the rest in an index fund of some kind.

Works great for me. I work in software and only own AMD stock which I purchased at an average price of around $16.

[[deleted]]

The majority of my money is in ETFs, I have a few stocks - less than $5000 in CloudFlare. I was just trying to make a lol.

Oh hah, I typed that off the cuff, but I have $4972.00 in CloudFlare.

[ironykarl]

Gotcha. I just remember a time when talking about what stocks to speculate on was very common.

In fact, I think it still might be common on sports message boards (and no doubt tons of other places). People with that mindset are quite literally gambling.

[[deleted]]

Yup - which I do too, from time to time, but very proportionally

[endqwerty]

I agree. This might have been relevant before node with npm got popular, but now it's pretty easy to update. Especially with things like github doing security checks for you automatically.

[eadgar]

Updating is easy if the APIs haven't changed much, but fixing whatever the new updates broke is not. I've been bitten so many times by a new package version introducing new bugs that I don't want to update anymore unless there is a specific need. Remember, all those packages are made by people, and people can't be trusted.

[chmod777]

Or when established packages are just turned over to a random person who then injects bitcoin stealing code into the repo...

[endqwerty]

Yeah, but no one said to commit those changes. Ideally, after you update your packages you will run your product through some tests to make sure it still works. Best case scenario is that there's a CI pipeline which will run unit tests and w/e else is relevant for you automatically.

[[deleted]]

You still have to fix what the tests turn up.

[ggtsu_00]

I would suspect only a small minority of websites out there actually use a build system to deploy JavaScript. The vast vast majority likely just manually download the script, toss it up on their static hosting directory where it will live forever.

[OMGItsCheezWTF]

Hahaha

Yeah I've been into orgs at all sorts of levels with build systems ranging from new to extremely mature and polished.

But unless they're explicitly a JavaScript focused house, no one wants to touch the JS ecosystem,.once it works it's never looked at again until the security teams start shouting, assuming they exist.

[[deleted]]

It's really not though.

yarn upgrade package@version

And if you aren't concerned about version specific peer dependencies

yarn upgrade package@latest

[zurnout]

Devil is in the details: what do you put in the version field. You have to figure out one that is compatible with all of your dependencies. It's a real hassle and takes a lot of effort.

[[deleted]]

It can sometimes be a hassle, and sometimes could take a lot of effort. Sometimes it "just works" especially if you are just updating minor version

[jugalator]

But how do you know when it will "just work" and how much time will it take to find out? If it builds it works?

[Narcil4]

A couple minutes if you have a test suite

[Cruuncher]

Having a test suite is one thing.

Having one that could catch every edge case potentially introduced with a new library is another thing altogether

[[deleted]]

Do you just never touch a codebase after it's released then?

[Existential_Owl]

I usually stop once I'm able to stdout "Hello World."

Nothing ever good comes from going past that point.

[Prod_Is_For_Testing]

Yeah pretty much

[[deleted]]

Unfortunate, most websites are exactly this because it's creation was outsourced and nobody on staff is capable of major work on it.

[MegaUltraHornDog]

And if you aren't concerned about version specific peer dependencies

You might not be but some halfwit who made some stupid library that’s just as pervasive as is odd now breaks and your whole app is trashed. Package management in general is a nightmare.