I would happily write stored procs using the current language support for a decade without pay, before I'd subject myself to putting javascript in a fucking database engine.
> And how is it "minutiae" to be able to figure out "is my database version actually supported"?
Remembering "8.4", "9.7" and ".4" just doesn't seem like a particularly big deal to me. The number* has only changed 3 times in the last 10 years.
To me the biggest "unknown" with Percona is that MariaDB (the company) bought out Codership (the creators of Galera Cluster, which XtraDB Cluster is based on) and it doesn't seem to be OSS any more.
I'm sure for some shops this will drive them to pay for the same feature in MariaDB cluster, but I'm more likely to just transition to MySQL Group Replication.
This is my whole point about MariaDB - they are steadily making their OSS software completely dependent on the company (paid) versions for anything beyond toy scale.
The comparison with MySQL/MariaDB is unfortunate, given that since the "split" MariaDB has shown itself to be every bit the corporate owned "FOSS" project while its supporters still harp on about how terrible oracle is for OSS, without actually acknowledging the real history of each respective project and accompanying company.
Given that MariaDB the company is now owned by a private equity firm, I doubt it's going to get better.
Access to source control is required on a developer workstation.
It is not required inside an application environment on that workstation (eg a VM or other such system that both provides a standard environment and creates separation)
I'm not making any claims about the security of react.
> If you already had left pad cached then you were not affected by its disappearance.
The evidence of course is that when you say "left pad" no one knows what you're referring to because nothing bad ever happened.
> If a package needs an install script to be used, to compile some native code for example, you still need to run the install script before you can use the package.
This already sounds like a giant red fucking flag, but sure whatever, what you're using needs some compile step. You can be in control of what runs when and where. Heck you could even take the fucking maverick solution and compile the shit once out of band and deploy the compiled binary to your production environment. I know that forethought and planning ahead will come as a fucking shock to the NPM using community, but try it some time, it's really kinda good.
> Manually repeating the actions npm does automatically does nothing to protect you from supply chain attacks.
I mean it does, inherently, if you're running those actions locally in an environment without production access...
Oh noes, your compromised module stole your DB credentials, and your SES credentials to spam all your customers..... and just got a bunch of failures or sent messages to no-one because the environment has dummy data and uses a locked down sending configuration for SES.
There is 100% benefit in running that shit in a development environment.
> The only thing that helps is to review code before you run it.
Right, and somehow you think having the code in question literally in your VCS, waiting for a merge like all the other code... that's not apparently helpful.
But hey thanks for proving me right about the unhinged complaints. Stong echoes of "we've tried nothing and we're all out of ideas".
I mean even if you blindly copy in the dependency (I'm not saying you should) you've already solved two supply chain issues with install-on-prod:
- dependencies "disappearing" (aka left pad 2, electric boogaloo)
- dependencies running nefarious "install scripts" on prod
Apparently some language package managers also will silently install newer versions than a lock file specifies, if you use the wrong install command. So that's arguably more a case of saving you from yourself but the example I saw said that "... install" is wrong you need to use "... ci" which is kind of asinine IMO.
Things like sudden changes in dependencies should also be noticed more readily.
If I show a person on the street a Fuji apple and a Honeycrisp and ask if they're approximately the same, they're going to say yes even if they're labeled.
Php has had a strict equals operator for decades. You not using it is not a language fault.
For the second point: I doubt you'll fine any language where you can just do an equals comparison on floats and it works as expected. That's the nature of floating point numbers.
> Yes, we punish the individual driver that did it, but we still allow humans to drive cars.
Yes because bad drivers aren't representative of all drivers. You also missed the part where laws are changed, safety laws are strengthened.
Oh wait. You're American aren't you.
In most of the world, laws are put in place to protect people. The Cybertruck for example, cannot be legally driven (regardless of not being for sale) in many countries because it doesn't meet pedestrian safety standards.
In my home state it's a finable offence to touch or even have your phone sitting in your lap while driving a car, and they've put detection cameras in place to enforce these laws.
So maybe define who you mean by "we" before claiming that people think kids being mutilated by negligent drivers of either the robotic or fleshy kind, is "good enough".
If a child is "folded in half" by someone looking at their phone, no one accepts that as "good enough", and there is a direct action: the driver responsible will lose their licence and likely end up in prison. If it happens often enough, laws are changed.
What happens when a Tesla does the same thing? Besides them lying and hiding information I mean. What remedial action is taken to reduce that specific risk from reoccurring?
... the only sarcasm I posted was about screaming at the universe in response to his suggestion that the only alternative to people loading up a text editor with a million shonky plugins to try and make it an IDE, is to eschew all IDEs.
The sarcasm was because this suggestion is ridiculous IMO. It's like saying "Tesla refuses to use state-of-the-art LIDAR for their attempts at an autonomous vehicle, therefore I shall only travel in vehicles that have both a driver and a conductor, and are propelled by beasts!".
VSCode being a turd isn't a reason not to use an IDE. It's a reason to use an actual IDE, rather than a glorified text editor, with the aforementioned millions of shonky plugins trying to recreate IDE levels of functionality.
Your comment implies that you've somehow misunderstood my comments and thus think that I am using Microsoft's hot garbage text editor with a million plugins.
If you've all been reduced to vibe coding and hoping for the best I'd suggest that you aren't really participating in the software industry either mate.
> And how is it "minutiae" to be able to figure out "is my database version actually supported"?
Remembering "8.4", "9.7" and ".4" just doesn't seem like a particularly big deal to me. The number* has only changed 3 times in the last 10 years.