We have a tendency to police our code ecosystems and it's harmful(jenn.glitch.me)
jenn.glitch.me
We have a tendency to police our code ecosystems and it's harmful
https://jenn.glitch.me/we-have-a-tendency-to-police-our-code-ecosystems-and-its-harming-our-community-4/
7 comments
Maybe a good rule of thumb is to 'police' anything that uses a shared namespace.
I guess people use a shared namespace until it goes wrong, then switch to a hierarchy.
But that's different from the real problem, you want usage rankings, reviews, advice, etc, when looking for a library to use, not just a list of names.
But that's different from the real problem, you want usage rankings, reviews, advice, etc, when looking for a library to use, not just a list of names.
Having frivolous modules (ala left-pad) brings down the quality of the ecosystem as a whole.
Even if you don't use them directly one of the modules you do include could include them, and they're pretty much only a source of security holes.
NPM in particular could do with much more policing. Between module hijacking, typosquatting, and a lack of security audits of any sort, fewer packages on NPM is a good thing in my opinion.
http://www.drinchev.com/blog/alert-npm-modules-hijacked/
http://incolumitas.com/2016/06/08/typosquatting-package-mana...
Even if you don't use them directly one of the modules you do include could include them, and they're pretty much only a source of security holes.
NPM in particular could do with much more policing. Between module hijacking, typosquatting, and a lack of security audits of any sort, fewer packages on NPM is a good thing in my opinion.
http://www.drinchev.com/blog/alert-npm-modules-hijacked/
http://incolumitas.com/2016/06/08/typosquatting-package-mana...
This is an advertisement for Glitch. Pure and simple.
Should we just ignore discoverability, or consider it a problem to be solved outside the ecosystem? It seems like every permissive app store has struggled with this virtually since its inception, for example.
1. Is it okay if I dump trash into a discovery-based system? (No) 2. Is it okay if I dump trash into a system with no discovery component? (Yes)
If you want to post notes to your personal website or github account, go nuts, people don't really browse the entirety of GitHub to find interesting repos, there are other discovery avenues.
However, if you want to publish a module on npm that consists of the line "return 60", that decreases the SNR in a system that is used for discovery. I don't know about npm specifically, but I do browse PyPI to find some interesting packages to use, and if everyone uploaded their throwaway code to it, it would erode my (and everyone else's) trust in the package archive.