Micropackages and Open Source Trust Scaling
I think this is a serious set of reasonable thoughts about the incident, and don't want to demean the article.<p>That said, I wish more people would talk both sides.  Yes, every dependency has a cost.  BUT the alternatives aren't cost free either.  For all the ranting against micropackages, I'm not seeing a good pro/con discussion.<p>I think there are several lessons to be learned here (nixing "unpublish" is a good one, and I've not been impressed with the reaction from npm there) the most important of which is probably that we should change our build process:  Dev should be pulling in updates freely to maintain the easy apply-fixes-often environment that has clearly been popular, then those should be pinned when they go past dev (to ensure later stages are consistent) and we should have some means of locally saving the dependencies to reduce our build-time dependency on package repos.<p>Sadly, though, I've not seen a lot of discussion on a reasonable way to apply those lessons.  I've seen a lot of smugness ("Any engineer that accepts random dependencies should be fired on the spot", to paraphrase an HN comment), a lot of mocker ("haha, look at how terrible JS is!"), and a lot of rants against npm as a private entity that can clearly make mistakes, but not much in the way of constructive reflection.<p>Clearly JS and NPM have done a lot RIGHT, judging by success and programmer satisfaction.  How do we keep that right and fix the wrong?