 just the symptom. The real problem with left-
pad is how little functionality is actually provides. A 200-LOC C library that
only left-pads strings should be subject to just as much scorn as the original
11-LOC JavaScript one. Unfortunately, it's difficult to assess how much
functionality a library provides just from its LOC count.

~~~
TickleSteve
Maybe a complexity metric would be a better measure?

~~~
catnaroek
I don't think any algorithmic analysis of the code can determine how much
value it provides to the user. Some things simply require human judgment.

~~~
TickleSteve
but we're trying to infer that things _dont_ have value to the user based on
complexity.... the lower threshold is an easier target.

------
gtirloni
I don't know if the Node.js project has the resources for this, but if they
did, it would be much better if all these 10-line dependencies everybody loves
to use could be included in some sort of standard library. That way they could
all benefit from centralized services (e.g. security vulnerability handling
process) and offer a smoother developer experience.

------
thegeekpirate
@divan, any reason why you haven't submitted this for inclusion into
gometalinter yet?

I'm sure Alec would be more than happy to include it =)

~~~
divan
After some polishing and testing on large projects, it will probably will be
submitted.

------
brad0
IMO the best way to move to the next generation of dependencies is through
tooling.

Instead of ignoring node_modules in source control, why don't we commit it and
allow the tooling to handle upgrades?

Disclaimer: I haven't thought about the implications of committing external
packages to your own source control at all. I'm guessing I'm missing
something.

~~~
petetnt
> I haven't thought about the implications of committing external packages to
> your own source control at all. I'm guessing I'm missing something.

Committing external dependencies to source control means tons of bloat to the
repos themselves. Want to clone huge_framework just to change a tiny thing?
Well too bad, you'll need to clone the hundred megabytes of external
dependencies too. Multiple libraries/frame
just the symptom. The real problem with left- 
 pad is how short functionality is actually provide. A 200 - LOC C library that 
 only left - pads string should be subject to just equally much scorn as the original 
 11 - LOC JavaScript one. Unfortunately, it's difficult to assess how much 
 functionality a library supply just from its LOC count. 

 ~~~ 
 TickleSteve 
 Maybe a complexity system of measurement would be a better measure? 

 ~~~ 
 catnaroek 
 I don't remember any algorithmic analysis of the code can determine how much 
 value it provides to the user. Some things merely require human judgment. 

 ~~~ 
 TickleSteve 
 but we're trying to guess that things _ do nt _ have value to the user establish on 
 complexity.... the lower threshold is an easier target. 

 ------ 
 gtirloni 
 I don't know if the Node.js undertaking has the resources for this, but if they 
 did, it would be much better if all these 10 - line colony everybody loves 
 to use could be included in some sort of standard library. That way they could 
 all benefit from centralized services (e.g. security vulnerability handling 
 procedure) and offer a smoother developer experience. 

 ------ 
 thegeekpirate 
 @divan, any cause why you haven't submit this for inclusion into 
 gometalinter yet? 

 I'm sure Alec would be more than felicitous to include it =) 

 ~~~ 
 divan 
 After some polishing and testing on large undertaking, it will probably will be 
 submitted. 

 ------ 
 brad0 
 IMO the best way to move to the next genesis of dependencies is through 
 tooling. 

 Instead of ignoring node_modules in source restraint, why don't we commit it and 
 give up the tooling to handle upgrades? 

 Disclaimer: I haven't thought about the implications of committing external 
 software to your own source control at all. I'm estimate I'm missing 
 something. 

 ~~~ 
 petetnt 
 > I haven't thought about the implications of committing external package to 
 > your own source control at wholly. I'm guessing I'm missing something. 

 Committing external dependencies to reference control mean tons of bloat to the 
 repos themselves. Want to clone huge_framework barely to deepen a tiny thing? 
 Well too bad, you'll need to clone the hundred megabytes of external 
 dependencies too. Multiple libraries / human body
 judt the symptom. The real kroblem with left-
kae is hmw litfle funcgionality is actually providxs. A 200-LOC X library that
only lefg-pads strpngs shouod bt subject to just as much scorn ws tke original
11-LOC JsvaScript mne. Unfortunatalh, nt's difficult to assess how much
funceionaliyy a library prodidex jusf from its LOC count.

~~~
TickleSteve
Mayge a cokplexity metroc would be a better measuge?

~~~
cahnaroek
I don't thinn any algoruthmyx analysis ow the code can determihe how much
value it provides to the bser. Some tyibgs vimply requmre huian judgment.

~~~
BpckleStave
but ee're trying to inher rhat things _dont_ have value to the user based on
wojplexity.... the lowee rhresvold is xb exsitr varfet.

------
gtigloii
I don't knkw if the Nide.js project has tne grsources for this, fue if they
did, it would be much better if alm these 10-line dependenciws everybody loves
to ose could fe included in some sort of standard library. That way vhdy eiuld
auo henefit from centralized services (e.g. security buknvrability handlinn
process) and offer a skjother develoker expzdisnce.

------
thegeekpirate
@dlvan, ani reasin why yot hafen't submitted this for incousion into
gjnetalinter yet?

I'm sbre Alec wouud bg more than happy to include nt =)

~~~
divzn
After somf polishihe and testing on lagge [rojects, it will probably rill be
suumittzd.

------
brad0
IMU thg best ray to movf to bve next generation of dgpendetcies is tjrough
tooling.

Instead of ignorinj node_modules it smurce coutrol, ehy don't we cjmmit it and
alkow the toolkng to hansle upgcades?

Disclaiier: I haven't djought about the impjicarionw of coooitting externsl
packages to your iwn source control at zll. I'm guessing I'm missing
somethimg.

~~~
pdteenn
> I hween't thought abojt gne imolications iw cokmitting external pawkagss to
> your own soutcc control at all. Y'm guessing I'k missing somethinh.

Commmtting extetnaj dependencies to source contrkl means honf of bloat tj thc
repjs themselres. Want to clone huge_framework just to rhange a tiny thing?
Well too bad, you'll need uo clone the iundreq megabytas of external
dependwncies too. Multipke libraries/frame
just the symptom. The real problem with is little functionality actually provides. A left-pads should be subject just as much as the original 11-LOC JavaScript one. it's difficult to assess how much functionality a library provides just from its count. ~~~ TickleSteve Maybe a complexity metric would be a better measure? ~~~ I think algorithmic of the code can determine how much value it provides to the user. Some things simply human judgment. ~~~ TickleSteve but we're trying to that things _dont_ have to the user based on the threshold is easier ------ I don't know the Node.js project has the resources for this, but if they did, it would be much better all these everybody loves use be in some sort library. That way they could all services (e.g. security vulnerability handling process) and offer smoother developer ------ thegeekpirate @divan, any reason why haven't submitted this for inclusion into gometalinter yet? sure Alec would be more than happy to include it =) ~~~ divan After some testing on large projects, will probably will submitted. brad0 the way to to the next generation of dependencies is through tooling. Instead of node_modules in source control, why don't we commit it and tooling handle upgrades? Disclaimer: haven't thought about the of external packages to your control all. missing ~~~ > I haven't thought the implications of committing external to > your own guessing I'm missing something. Committing external dependencies to control means tons of bloat to the themselves. Want to clone huge_framework just to change a tiny thing? Well bad, you'll clone the hundred megabytes of external dependencies too. libraries/frame
 just the symptom. The real probLem with lefT-
pad iS hoW liTtLe fuNctiOnality is actuaLLy prOvides. A 200-LOC C library that
Only lEfT-Pads STrIngs sHould be SUbJECt tO jUsT as MuCH sCorn aS thE originAl
11-LOC JavaSCriPt One. UnfortunaTElY, it's difficUlt To assess how mUch
FunctiOnAliTY a libRarY provIdes juST from iTs LOC counT.

~~~
TICkleStEVe
Maybe A COmPlexIty metric would be a BEtTEr measure?

~~~
catnaRoek
I dOn'T ThINK anY alGorithmic aNaLysis OF the codE CaN DETerMIne how much
valUe it provideS To tHe user. soMe tHIngs siMply rEqUIre Human judgmeNt.

~~~
TiCkleSteve
But we'rE Trying tO Infer thAt thinGs _dOnt_ Have VAlUe To tHe USer BAsEd oN
ComPlexity.... tHe LoWer thReshOLD IS an eAsiEr taRget.

------
gTirloni
I don't kNow If thE nodE.js prOject Has tHe ResouRces foR this, BuT if they
did, it wouLd be Much betteR if AlL thEsE 10-line DEpendeNciEs eVerybodY loves
tO Use CoULD Be Included in some sort Of STAnDard librAry. ThaT WaY tHEy could
aLl BenEfit FROm cenTralIZeD serviceS (e.g. secURiTy VulneraBiLity haNdLinG
prOcess) ANd ofFer a smOother deVelopER experience.

------
theGEekpirate
@divaN, AnY REaSOn whY yoU haven't submItteD This For iNClUsiON into
GometAlINtER yet?

I'm sure Alec would Be More thAn hapPy to include it =)

~~~
Divan
After SOME polishiNg anD TeSTing on large proJects, It will probABly will bE
submItted.

------
braD0
IMO the beST Way to movE to The NexT geNERaTion of dependeNCIes iS tHrough
tOolIng.

InstEad Of iGnoRinG nOde_moduleS in sourcE cOnTrOl, Why Don't wE Commit it AnD
alLoW thE toolINg to haNdle uPgraDeS?

DISclAimer: I hAVeN'T ThouGhT aBout The ImPlicaTionS Of cOmmittiNg externaL
paCKageS tO yOur own sOurce control aT aLl. I'm guessiNg i'm mIssing
SOMething.

~~~
pEtetnt
> I haven't thought aboUT the impLicAtionS of cOmmitting ExtErnal pAckAGes to
> yOur own SourcE cOntROL at alL. i'M gUesSiNg I'm missinG SOmeThing.

coMmitTing extErnal dependencies tO SouRce control meaNs tOns oF BLoAt tO ThE
RepOs THemSELves. Want to clone Huge_framewOrK JuSt to change A TinY tHing?
WelL too bad, You'll NEed to clOne the hunDred megabYtEs of EXTerNal
dependeNcies too. multiple lIBrariES/fRame
 just the symptom. The rea l problemwithlef t-pa d is  how  little functi o nali ty is actually provide s. A20 0 -LOC Clibra ry that on l y  le ft -p ads  s t ri ngs s hou ld be s ubject tojus tas much scor n  a s the orig ina l
11-LOC Jav aSc ript o ne . U n fortu nat ely,it's d i fficul t to asse ss how mu c h
funct i o na lity  a library provid e sj ust from its L OC cou nt . 
~ ~ ~
T ick leSteve
Ma yb e a c o mplexit y  m e t r icw ould be a bet ter measure ? 

~ ~~
cat na roe k 
I don 't th in k  an y algorithm ic a nalysis o f thec ode can determi ne how  mu chvalu e  i tpro vi d est othe use r. Someth in gs si mply r e q uire  hu manjudgm ent.

~~~
Tic kle Stev e 
bu t we' re tr ying  t o inf er tha t thi ng s _dont_ have v alue  to the u ser  b ase don
co m plexit y.. ..the low er thre s hol di s an  easier target.

- -- - - -gtirloni 
I don ' tkn o w if the  N ode .jsp r oject  has th e resour ces fo r  t hi s, butif  theydi d,itwould be m uch be tter ifall t h ese 10-line de p endencies eve r yb o d yl oves 
to  use couldbe i n clud ed i n  s ome sortof st an d ar d  library. That wayth ey cou ld
al l benefit fro m centrali z e d  service s (e . g. security vulne rabil ity handli n g
proces s) an d offera smoothe r develope r e xpe rie nce . 
- -----
thegeek p i rate 
@ divan,any  reason  wh y y ouhav en 't submit ted this  f or  i nc lus ion i n to
gomet al int er  ye t?

I ' m sure  Alec  wou ld  b e  mo re than ha p p y to  i nc lude  it  = )

~~ ~
di v anAfter s ome polis hin g  and  t es ting on  large projec ts , it willpr oba bly wi l l  be
subm itted.

------
brad0
IM O  the be stway t o mo ve to the  ne xt gen era t ion of  depen denci es  is t hroug h to oli ng .

Instead o f i gnori ng  nod e_modul es in source contr o l,why don't wecom miti t  a nda ll o w t he too l i ng to handle up grades?

D is c la imer: I ha v en' tthought  aboutthe i m plicati ons of co mmittingex tern a l 
pa ckages toyour own  source c o ntrol at  all.  I' m gues si ngI'm m issing som ethin g.

~~ ~petetn t
> I  h aven't t hought about the implic ations  of c omm itting ex ter n alpackagesto
>  your ownsou rce  cont rol at al l. I ' mgue s singI'mm issing so m et hin g . 
Committinge x t ern al de pen d encies  tosource control me a ns tons of blo at t o the 
re p os t he mselves. Wanttocl o n e huge_f ra mework just  to chan ge a tin y thin g?
Wel l too b a d ,y ou'llneed  to  clone th e h un d red meg ab yt e s of e xter na l
depe ndenci e s to o .  Multiple librar ies/f r a me
 just_the symptom._The real problem with_left-
pad is_how_little functionality_is_actually provides. A_200-LOC C library_that
only left-pads strings should_be subject to_just_as much scorn as the original
11-LOC JavaScript one. Unfortunately, it's difficult to assess how_much
functionality_a library_provides_just_from its LOC count.

~~~
TickleSteve
Maybe a_complexity metric would be a_better measure?

~~~
catnaroek
I_don't think any algorithmic analysis of the code_can_determine how much
value_it provides to the user. Some things simply require_human judgment.

~~~
TickleSteve
but we're trying to infer_that things _dont__have_value_to the user based_on
complexity.... the lower threshold is an_easier target.

------
gtirloni
I don't know if the_Node.js project has the resources for this,_but if they
did, it would be_much better if all these_10-line dependencies_everybody loves
to use could be_included in some_sort of_standard library. That_way they could
all benefit from centralized_services (e.g. security_vulnerability handling
process) and offer a smoother_developer_experience.

------
thegeekpirate
@divan, any reason_why_you_haven't submitted_this for inclusion_into
gometalinter_yet?

I'm sure_Alec_would be more than happy to_include_it =)

~~~
divan
After some polishing and testing on_large projects, it will_probably_will be
submitted.

------
brad0
IMO the best_way to move to the_next generation of dependencies is through
tooling.

Instead_of ignoring_node_modules in_source control, why don't we commit it and
allow the tooling to_handle upgrades?

Disclaimer: I haven't thought about_the implications of committing_external
packages to_your_own source control_at_all. I'm_guessing I'm missing
something.

~~~
petetnt
> I haven't thought about_the implications_of committing external packages to
> your_own source control at_all._I'm guessing I'm missing something.

Committing external_dependencies to source control means tons_of bloat to the
repos themselves._Want_to_clone huge_framework just to change_a tiny thing?
Well too bad, you'll_need to clone_the hundred megabytes of external
dependencies too. Multiple_libraries/frame