• 0 Posts
  • 11 Comments
Joined 8 months ago
cake
Cake day: June 3rd, 2025

help-circle




  • I completely agree with you on the second point. This is a problem for all languages, but maybe we (as a community) need to change the approval, reviewing process for adding new libraries and features to languages.

    This isn’t going to get any better unless we revert to OS based dependencies which noone wants to do because developers want the latest and greatest.

    You’re very succinct here: Developer do want the latest and greatest, even if the interface isn’t perfect, and they’ll need to refactor their code when the next revision comes out.

    Languages often have much slower release cycles than 3rd party libraries. Maybe this is what needs to be improved.

    There won’t be a silver bullet, but I kinda like how kubernetes handles it: release cycles are fixed to a calendar (4 times per year). New features are added and versioned as alpha, beta, release. This gives the feature itself time to evolve and mature, while the rest of the release features are still stable.

    If you use an alpha/beta feature, you accept that bugs and interface changes will occur before it reaches a stable release. … and you get warning and errors, if you’re using an alpha feature, but it graduated to beta/release.

    Unfortunately, many languages either make this unnatural/difficult (ie: from future import... ) or really only support it if you’re using 3rd party libraries (use whatever@v1.2.3-alpha1).


  • LedgeDrop@lemmy.ziptoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    7
    arrow-down
    1
    ·
    1 month ago

    The way I see it, there are two problems with NPM:

    1. It can blindly run any shell command w/o the developers explicit permission.
    2. Anyone can make an NPM module, and the community is so fractured - common tools/features are not built into the language (or a standard library or a “vetted” community library - like boost for C++)

    The first issue might be solvable with things like WebAssembly. Then it’s the developer who gets to decide how far these pm-hooks will reach (both interns of filesystem, network, etc) on a per project basis.

    The second will need a shift in community mindset… and all these supply chain attacks are the fuel for that. Unfortunately, it needs to get worse before it’ll get better.






  • For me the biggest question is: “Will these City-ran grocery stores, be able to complete with the Walmart juggernaut?”

    Yes, initially the city-ran stores will be placed in “food deserts”, but if the program is to succeed it need to go toe-to-toe with Walmart. Otherwise, the program won’t be able to reach the people who need it the most.

    … and based on the article you posted, I’m sure Walmart won’t take this lying down. Walmart will have no second thoughts or remorse to sacrifice their suppliers in order to compete (thus, keeping customers flocking to their store).