A single Node of failure [LWN.net]

A single Node of failure

Posted Apr 1, 2016 17:28 UTC (Fri) by bronson (subscriber, #4806)
In reply to: A single Node of failure by samroberts
Parent article: A single Node of failure

It's not as similar as you imply. Those few Rails gems are used by tons of people and updated a few times per year, tops. Those many Node gems are in a constant state of churn.

> Reviewing left-pad for security defects, for example, should be a matter of minutes.

Multiply that by 400 dependencies, remember?

to post comments

A single Node of failure

Posted Apr 1, 2016 21:32 UTC (Fri) by samroberts (subscriber, #46749) [Link] (1 responses)

rails line count of .rb files (excluding anything with test in the name or path): 111895 (1003 files)

express line count of lib/**/*.js: 3879 (11 files, I counted by hand)

And, yeah, your average express app uses a bunch of middleware... none of which will be as big and complex (<4000 lines) as express itself.

You can multiply by 400 all you want, and raise fear about OMG look how many modules node uses, its INSANE... but the fact remains, rails itself contains more code even before you add some gems than the 100s of package dependencies of many node projects.

Its just a different way of doing things. Node does a package per function or small set of functions, other languages have package systems that are so clunky and hard to use, they have to deliver code in large libraries, composed of dozens to 100s of files, and 100s to 1000s of APIs.

And sure, rails is used by a lot of people... but so is express and the set of packages around it, including, implicitly and recursively, all the dependencies.

A single Node of failure

Posted Apr 1, 2016 22:31 UTC (Fri) by bronson (subscriber, #4806) [Link]

I must be misunderstanding you... It sounds like you're talking about rails/rails? That's nine gems, plus database adapters, etc... How does it make any sense at all to compare it to the Express package?

Even if it did, I'm not sure how your comment applies to anything I said... Where am I talking about lines of code?