Victor Vlasenko

Maintainer of node_modules support at @yarnpkg, Founder of @sysgears, Ex cryptography department head at @BIFIT

[Victor Vlasenko @larixer]

I have started working on a tiny lockfile-less package manager for JavaScript:
https://t.co/5BFTouVav7
It implements bare-bones `node_modules` installs with workspace support.
I am already using it for a couple of my open source packages `webpack-virtual-modules` and `mochapack`

[Victor Vlasenko @larixer]

@AsafAgami92 @liran_tal Not all benchmarks are pointless. But these are pointless for sure.

[Victor Vlasenko @larixer]

@trevmanz @rahuldave The link to the implementation:
https://t.co/5BFTouUCFz

[Victor Vlasenko @larixer]

@trevmanz @rahuldave Interesting, I've tried the same for JavaScript dependency resolution. It is deterministic (provided the registry publishing history is consistent). Plus, when new dependency added to the project and it is newer then point in time, minimum compatible version should be used.

[Victor Vlasenko @larixer]

@matteocollina I understand. Maybe it's not the only/the best viable model even for cases with limited economic incentives.

[Victor Vlasenko @larixer]

@matteocollina My comment was not about when benevolent dictator model works, it was about possible better alternative to this model.

[Victor Vlasenko @larixer]

It would be a great experiment if we appointed key maintainers with limited term powers to an open source project based on secure RNG (fair coin flipping) among the group of willing contributors. Contributors sense of ownership and user trust would increase in such a project.

[Victor Vlasenko @larixer]

@jasnell Have you considered fair coin flipping protocol to appoint TSC members with a limited term powers - to lower the risk of power misuse/foundation degradation in the long run?

[Victor Vlasenko @larixer]

Automattic Is Doing Open Source Dirty
https://t.co/BqX8UrrPEZ

I disagree with the author. I don't think Wordpress drama has serious risks for open source. Because the grounds for the drama is Trademark misuse (seems null and void legally), not open source license misuse.

[Victor Vlasenko @larixer]

@ematipico @NicoloRibaudo It's more a responsibility of a linter than a package manager. Package manager responsibility is to install dependencies satisfying package.json. Some people think that npm is exposing non-direct dependencies on purpose while it is doing so more for perf and min-space reasons.

[Victor Vlasenko @larixer]

@nev_nein @NicoloRibaudo If npm will not expose non-explicit dependencies this will result in bigger and slower installs. I'd say it is not a responsibility of a package manager, it is a responsibility of linting tools.

[Victor Vlasenko @larixer]

@NicoloRibaudo @kettanaito And if you try to do this in npm compatible way like Yarn does with `nmHoistingLimits: dependencies` you will end up with a bit bigger and slower installs and people will say, hey this package manager is "slower", why should we use it, so not enabled by default as well.

[Victor Vlasenko @larixer]

@NicoloRibaudo @kettanaito pnpm uses alternative install layout, which has problems with symlinks, not all of the packages handle them well, so suggested "cure" might be not better then the "disease".

[Victor Vlasenko @larixer]

@arcanis So it should prefer dependency versions before `lockTime` in all cases, except those cases where it is impossible. And where it is impossible - lowest in the requested range will be downloaded.

[Victor Vlasenko @larixer]

Lockfiles used in JavaScripts projects can be harmful from security and stability perspectives. You have machine generated data in your repository that is used for package manager decisions to download additional code. (1/4)

[Victor Vlasenko @larixer]

@arcanis When you add unrelated dependency years later it will get the highest version of the dependency that existed at `lockTime` moment and all the other dependencies will not be affected.

[Victor Vlasenko @larixer]

it does not mix dependencies from the future with dependencies from distant path, thus reducing bugs and increasing stability. So it has not only security, but also compatibility benefits.
(4/4)

[Victor Vlasenko @larixer]

`lockTime` field is used instead in the `package.json` to fixate the time of the install, dependencies having the highest versions that existed before this time point are used. This approach picks the dependencies from the same time epoch - versions that existed together
(3/4)