Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add dependencies metric in pm2 comparison #5

Open
RealDolos opened this issue Jan 15, 2018 · 0 comments
Open

Add dependencies metric in pm2 comparison #5

RealDolos opened this issue Jan 15, 2018 · 0 comments

Comments

@RealDolos
Copy link
Contributor

You already compare LOC, however that's only part of the truth... The actual LOC that will be (potentially) running on one's system are not just the lines from the projects but also from all of those dependencies.

The node "community" has a tendency to add a metric (or maybe even imperial) shitton of dependencies to everything they code... libraries of quite varying[0] quality which in turn pull in even more libraries of varying quality.

Furthermore, there were finally some blogs pointing out how many of the node community will often blinding import third party code, commonly the minified and transpiled "release" versions that even cannot be audited, without anybody ever considering the possibility of an evil actor[1].

As such, it is preferable that:

  • Any and all dependencies have merit and purpose being there. [2]
  • Authors, such as yourself, are aware of the pros and cons of dependencies and vet any new (and occasionally re-vet old) dependencies
  • Authors make it known that they are.

In the end, I[4] gotta trust you as an author[5].

[0] "varying" in this context obviously means inefficient, insecure and generally crappy.
[1] Putin himself hacking your node app to change the outcome of the election in your country.
[2] aka. you're not too lazy or unskilled to google String.prototype.padEnd on MDN[3]
[3] the npm leftpad/padleft/padgenericfromtheleftexceptwhenpassingaconfigurationobjecttopadrightinstead packages are serious quality softwares that should be included in every node project
[4] properly tinfoiled at almost all times
[5] I kinda trust you so far, even tho you're from Bavaria.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants