So any developer could make this in five minutes, but for some reason they can&#x27;t verify whether or not it works? That doesn&#x27;t make sense.In reality it could take an hour to get this working properly, but it does take only a couple minutes to verify that the solution here is correct. There are certainly good reasons for not adding extra dependencies to your project, but trading a known amount of time to check that an existing project does what you want for an unknown amount of time to redo it yourself is probably not a great bet.

Most of the time this is something you inherit. Not something you wrote.

I agree. But I find two problems with your proposal:1- Maintaining a mirror of dependencies can be a non-trivial overhead. In this app that I was working on, the previous devs had forked some gems on github, and then added that specific github repo to the requirements. But they did not do it for every dependency, probably they did not have time&#x2F;resources to do that.2- As a corollary to the above, sometimes the problem is not the package itself but compatibility among packages. E.g. package A requires version &lt;=2.5 of package B, but package C requires version &gt;= 2.8 of package B. Now I hear you asking &quot;then how did it compile in the frist place?&quot; probably the requirement was for package A v.2.9 and package C latest version, so while A was frozen, C got updated. This kind of problems is not solved by forking on Github, unless you mantain a different fork of each library for each of your project, but that&#x27;s even more problematic than maintaining dependencies themselves.P.S. At least for once, it wasn&#x27;t &quot;my fault&quot;, I didn&#x27;t build that app LOL ;-)

So, in the context of this discussion... you should make use of micro-modules to reduce code duplication, avoid defects, etc. However, don&#x27;t expect those micro-modules to be maintained or available in the future; so you need to set up your own package cache to be maintained in perpetuity.Or, you can implement the functionality yourself (or copy&#x2F;paste if the license allows) and avoid the hassle.

There&#x27;s more to dependency hell than &quot;oops, the package disappeared.&quot; Try updating one of those dependencies because of a security fix, and finding that it now depends on Gizmo 7.0 when one of your other dependencies requires Gizmo &lt; 6.0.

I&#x27;ve been in the same situation as OP many times (although in most cases I&#x27;ve been brought in fix someone else&#x27;s code).In the Ruby ecosystem, library authors didn&#x27;t really start caring about semantic versioning and backwards compatability until a few years ago. Even finding a changelog circa 2011 was a godsend.I think this was mainly caused by the language itself not caring about those either. 10 years ago upgrading between patch releases of Ruby (MRI) was likely to break something.At least this is one thing JavaScript seems to do better.

&gt; Try to rebuild that thousand-dependencies app in three years from now and you&#x27;ll see ;-)This is your fault for expecting free resources to remain free forever. If you care about build reproduction, dedicate resources to maintain a mirror for your dependencies. These are trivial to setup for any module system worth mentioning (and trivial to write if your module system is so new or esoteric that one wasn&#x27;t already written for you). If you don&#x27;t want to do this, you have no place to complain when your free resource disappears in the future.

Long story... we had the git repo but lost access to any working installation. I had to rebuild a dev vagrant VM first, and later on a production-ish setup on a server.

PS I did not downvote you and I find your question legitimate...

I can&#x27;t speak for him, but upgrading really old Rails apps can get complicated very quickly. Especially when you&#x27;re going across multiple major versions and have to deal with significant changes in Rails behavior and broken gems. &quot;Rebuild&quot; might not be the most accurate way to describe the slow, steady incremental approach you&#x27;re forced to take (you aren&#x27;t redoing huge swaths of your domain logic, for instance), but it gets the gist across.The same goes for almost any legacy app.

The gemfile.lock must have been &quot;gitignored&quot; at some point, because it had much older packages than the ones in Gemfile. Background: all we had was a git repo and did not have access to any &quot;living&quot; installation.

Shouldnt the Gemfile.lock have prevented that? It takes your gemfile and makes a specific-version locked file of those gems.

Not to mention a good chunk of the companies they were writing this type of code for won&#x27;t exist by then either...

I never can believe how often frontend developers talk about &quot;you&#x27;re just going to rebuild it all in 2 years&quot; anyway.  I guess it&#x27;s a good way to keep yourself employed.

&gt; Try to rebuild that thousand-dependencies app in three years from now and you&#x27;ll see ;-)Let&#x27;s be honest though, in the current trendy javascript ecosystem these people will already be two or three jobs away before the consequences of their decisions become obvious. Most of the stuff built with this is basically disposable.

I find large dependencies like RoR itself cause a lot more dependency hell than zillions of small dependencies like this one. What kind of dependency hell could possibly happen for a module like this?

Usually, dependency hell doesn&#x27;t bite you, until it does. Try to rebuild that thousand-dependencies app in three years from now and you&#x27;ll see ;-)I recently had to rebuild a large RoR app from circa 2011 and it took me longer to solve dependencies issues than to familiarise myself with the code base.Excessive dependencies are a huge anti-pattern and, in our respective developers communities, we should try to circulate the idea that, while it&#x27;s silly to reinvent the wheel, it&#x27;s even worse to add unnecessary dependencies.

Oh God yes. After being spoiled in npm-land for a couple of years, I went back and tried to re-release a very small python module I had written before. I simply couldn&#x27;t do it. Oh well!

Very true. Although pypi is in a better position than npmjs.org on a few fronts (including security), it&#x27;s also such a pain in the arse to deal with. 
Packaging is by very far my least favourite part of python.

In a way this shows what a great job NPM did at making it easy to publish packages. It&#x27;s so easy that people decide to package up extremely easy functions.As a python developer I would never publish a small package, simply due to the overhead of setting up a PIP package.

Probably they do use that if they need left padding but also have a dependency on another package that thinks &#x27;lodash is too big when all I need is left padding&#x27; so we get to this situation

What if lodash itself was unpublished?
I&#x27;m having a hard time drawing a line here, obviously a 10 line function is too far on the bad side of lazy, but I can&#x27;t tell what is an acceptable dependency.

Looking at the changelog, there have been more than 70 versions of Lodash in less than four years. The first was in April 2012. [1]<pre><code> _.padleft
</code></pre>
does not exist. It was added as part of version 3.0.0 January 26, last year and renamed to _.padstart in Version 4.0 on January 12, this year.So in less than a year &quot;padleft&quot; came and went away because all strings don&#x27;t start on the left and someone decided that &quot;left&quot; means &quot;start&quot; except that the reason that it doesn&#x27;t is the reason that it was changed. Even worse, the 4.0 documentation does not document that _.padstart renamed _.padleft. It&#x27;s hard to grok what cannot be grepped.Why blame someone for depending on padleft in a world where libraries swap out abstractions in less than a year? Breaking changes are bad for other people. Semantic versioning doesn&#x27;t change that.[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;lodash&#x2F;lodash&#x2F;wiki&#x2F;Changelog" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;lodash&#x2F;lodash&#x2F;wiki&#x2F;Changelog</a>

So many people use lodash as a drop-in standard addon library that I&#x27;m surprised people aren&#x27;t just using the padding functions that are right in there... Some of the packages that broke yesterday even have lodash included as dependencies already!

Agreed the JavaScript standard library is poor and instead of addressing it they&#x27;ve mostly just added syntax changes to ECMAScript 6 and 7. It&#x27;s incredibly disappointing.For instance I added a utility to my own library (msngr.js) so I could make HTTP calls that work in node and the browser because even the fetch API isn&#x27;t universal for some insane reason.

I think in some ways a good standard library is a measure of programming language maturity. I remember when C++ had a lot of these problems back before you had the STL etc. In the early 90&#x27;s it was a dog&#x27;s breakfast.We have a large internal C++ app at my work of that vintage (~1992) it uses its own proprietary super library (called tools.h++) which is just different enough from how the C++ standard evolved that its not a simple task to migrate our codebase. So now every time we change hardware platforms (has happened a few times in last 30 years) we have to source a new version of this tools++ library as well.I find it amusing Javascript hasn&#x27;t learnt from this.

This seems like the right answer to me. It&#x27;s not that we forgot how to program, it&#x27;s that Javascript forgot a stdlib. You could easily write your own left-pad function in any language, but a stdlib (or this module) gives you a standard way to reference it, so you don&#x27;t have to look up what you named it or which order the args go in.

I think it speaks to just how lacking the baseline Javascript standard library is. The libraries that come with node help, but all of this stuff seems like it should be built-in, or at least available in some sort of prelude-like standard addon library. The lack of either leads to all these (apparently ephemeral) dependencies for really simple functions like these.That said, I work with Java, Clojure and Python mostly so I may be more used to having a huge standard library to lean on than is typical.

Someone mentioned below that lodash had some breaking changes related to the padding functions a couple times, which could be a totally valid reason to avoid using those. I was under the impression that the lodash API was more stable than to have that kind of thing happening.

Some of the libraries people were mentioning broke yesterday already have lodash as dependencies, I have no idea why they wouldn&#x27;t have just been using this...

For what it&#x27;s worth, that&#x27;s what I read in to it too.

&gt; However, I agree it is ridiculous to have a dedicated module for that one function. For most nontrivial projects I just include lodash, which contains tons and tons of handy utility functions that save time and provide efficient, fast implementations of solutions for common tasks.I think that was largely the OP&#x27;s point tbh. Using something like lodash [a utility library] is fine while using a module [for a single function] is not.It might have gotten lost in the ranting from on high but I don&#x27;t think the author truly meant more than that.

The problem is not that, the problem is depending on unreleased versions, instead of simply depending on the version that was written when u wrote your code.a Git submodule like approach would be much better

Worse yet, a backdoor or legitimate bug in any of these module could leave huge exploits in the entire Node.js ecosystem.

I think the article&#x27;s thesis is essentially that every dependency your project pulls in -- which includes all the dependencies your dependencies pull in -- is a point of potential failure. I understand the &quot;don&#x27;t re-invent the wheel&quot; defense, but the Node&#x2F;JavaScript ecosystem tacitly encourages its users to build vehicles by chaining together dozens of pre-made wheels, all of which depend on more wheels, and each and every one of those wheels has a small but non-zero chance of exploding the next time you type &quot;npm update.&quot;(And, y&#x27;know, maybe it&#x27;s because I&#x27;m not a JS programmer, but the notion of looking for a module to implement a string padding function would never have even occurred to me.)

This entire comment thread is such a breath of fresh air. I was beginning to think that I was that guy who was crazy for thinking that all of the people doing this were crazy. This thread is like my new support group.

&gt; It makes no sense to bring in a module from a third party adding yet another dependency and potential point of failure when reimplementing it yourself literally takes as long as it takes to find the module, add it to package.json and run npm install.Even if it does take the same amount of time (which it shouldn&#x27;t), a 1-line call to a standard module imposes less of a future maintenance burden than 14 lines of custom code.&gt; People should be trying to limit dependencies where possible. Reproducible builds are really important if it costs you almost no time you should have it in your code base IMO.That&#x27;s a non sequitur. Reproducible builds are important, but unless you write code with 0 external dependencies you already have a system in place for handling library dependencies in a reproducible way. So why not use it?&gt; People taking the DRY principle to the most extreme degree always makes for the worst code to debug and maintain.This is the opposite of my experience.

&gt; Why waste time and lines of code implementing something so trivial when there is already a solution available?Because it&#x27;s so trivial? I can&#x27;t wrap my head around why this is an argument in the first place. It makes no sense to bring in a module from a third party adding yet another dependency and potential point of failure when reimplementing it yourself literally takes as long as it takes to find the module, add it to package.json and run npm install.People should be trying to limit dependencies where possible. Reproducible builds are really important if it costs you almost no time you should have it in your code base IMO.People taking the DRY principle to the most extreme degree always makes for the worst code to debug and maintain.

Finding this module on NPM or npmsearch.com is pretty trivial compared to ensuring you implement this in a way that catches every edge case.&gt; It manifests in much slower bug fixingI don&#x27;t buy this at all, because I&#x27;ve done it myself many times. If you&#x27;re waiting on a PR from the original repo owner to fix a Production bug, you&#x27;re doing it wrong. It&#x27;s trivial to copy the dependency out of node_modules and into your src, and then fix the bug yourself. Then when the owner accepts your PR, swap it back in. I don&#x27;t understand the problem here.

TIL Java&#x2F;.NET&#x2F;Perl&#x2F;Python&#x2F;PHP&#x2F;Ruby are all wasting bandwidth forcing people to download there leftPad bundled in their SDK.

&gt; You don&#x27;t make it less probable to have those bugs (because battle-tested package! except, not so much in JavaScript, or Ruby, for that matter)Battle-tested still applies - if you have that many people using a line of code they&#x27;re more likely to find any bugs. (Formal proof is better than any amount of testing, but no mainstream language requires formal proof on libraries yet)&gt; And then, dependencies have their own cost later. You actually need a longer project, not a throw-away one, to see this cost. It manifests in much slower bug fixing (make a fix, find the author or maintainer, send him&#x2F;her an e-mail with the fix, wait for upstream release, vs. make a fix and commit it), it manifests when upstream unexpectedly introduces a bug (especially between you making a change and you running `npm install&#x27; on production installation), it manifests when upstream does anything weird to the module, and it manifests in many, many other subtle and annoying ways.Large monolithic dependencies have this kind of problem - &quot;we upgraded rails to fix our string padding bug and now database transactions are broken&quot;. But atomised dependencies like this avoid that kind of problem, since you can update (or not) each one independently. Regarding fixing upstream bugs, you need a good process around this in any case (unless you&#x27;re writing with no dependencies at all).

&gt; I don&#x27;t see anything wrong with using a pre-made left pad function. Why waste time and lines of code implementing something so trivial when there is already a solution available?I&#x27;ll tell you why.The least important ones is that downloading such trivial module wastes
bandwidth and resources in general (now multiply this by several hundred
times, because of dependency fractal JS sloshes in). I would also spend much
more time searching for such module than I would implementing the damn
function.More important is that you give up the control over any and every bug you
could introduce in such trivial function or module. You don&#x27;t make it less
probable to have those bugs (because battle-tested package! except, not so
much in JavaScript, or Ruby, for that matter), you just make it much harder to
fix them.And then, dependencies have their own cost later. You actually need a longer
project, not a throw-away one, to see this cost. It manifests in much slower
bug fixing (make a fix, find the author or maintainer, send him&#x2F;her an e-mail
with the fix, wait for upstream release, vs. make a fix and commit it), it
manifests when upstream unexpectedly introduces a bug (especially between you
making a change and you running `npm install&#x27; on production installation), it
manifests when upstream does anything weird to the module, and it manifests in
many, many other subtle and annoying ways.

I&#x27;d be amazed if lodash were unpublished.Using a library like lodash makes a lot more sense once you use a module bundler that allows tree shaking (like Rollup or Webpack 2.0) along with the ES6 module syntax. Heck, even if you&#x27;re just using babel with Browserify or Webpack 1.x, you can use babel-plugin-lodash [0] so it&#x27;ll update your imports and you only pull in what you need.[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;lodash&#x2F;babel-plugin-lodash" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;lodash&#x2F;babel-plugin-lodash</a>

I agree that Lodash would be a better choice because it seems like a well maintained project. There could be two counter args, in theory:- if the programmer uses other functions included in Lodash his code will have a single larger point of failure. For example, if Lodash is unpublished (intentionally as in this case, or unintentionally) then the programmer will have a lot more work to redo.- Lodash introduces a lot of code, while the programmer only needs one of its functions to pad a string.

Every function in Lodash is also available as a dedicated module, for the same reason left-pad existed: <a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;lodash.padstart" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;lodash.padstart</a>

If it was a good implementation, I&#x27;d agree with you, but it&#x27;s not: <a href="https:&#x2F;&#x2F;github.com&#x2F;azer&#x2F;left-pad&#x2F;pulls" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;azer&#x2F;left-pad&#x2F;pulls</a>

I don&#x27;t see anything wrong with using a pre-made left pad function. Why waste time and lines of code implementing something so trivial when there is already a solution available?However, I agree it is ridiculous to have a dedicated module for that one function. For most nontrivial projects I just include lodash, which contains tons and tons of handy utility functions that save time and provide efficient, fast implementations of solutions for common tasks.Lodash includes `padStart` by the way (<a href="https:&#x2F;&#x2F;lodash.com&#x2F;docs#padStart" rel="nofollow">https:&#x2F;&#x2F;lodash.com&#x2F;docs#padStart</a>).

I think it actually is not. That&#x27;s from some years ago and my memory of it is fuzzy, but at that time it was surprisingly hard to check whether a variable is a positive integer – maybe it was a negative one though and that was harder? You&#x27;d think it is just checking whether it is an integer and bigger than 0, or just checking whether it is bigger than 0. And it is. But to get that code to work reliably, regardless of whether it gets a string or float or an undefined, with the JS type system of that time and in multiple browsers, even the crappy ones, that took some time. There was one specific edge case involved.Not that it was impossible, but I still remember having to search for it and being astonished that that was necessary.Sure, should not apply anymore like that.

Yea. I don&#x27;t think many argue against abstracting complexity into more easily understood orthogonal modules. But some of these modules aren&#x27;t abstracting complexity. They are ludicrous. They are nonsense. They are a symptom of a very real problem with how JS is programmed, how people expect to program in JS, and the difficulty people have with decomposing problems.So many people on this page have written about how these are well tested, performant, and correct modules. But, the modules aren&#x27;t even correct in many cases, let alone providing incomplete coverage over edge cases or the slow performance and horrendous dependencies of many of the modules.

Yeah, I thought the dependency thing was a joke (I mean, to have a package for is positive integer is already a joke, but come on)Really

For some reason I misread that as &quot;do one thing and do one thing ugly&quot;. Either way, it applies.Lodash does this (and versioning, and clean code, and tests) really well though.

Philistine! You should just be doing i things.

No, its a byproduct of programming-interview-via-GitHub-repo

I think this is some sort of cargo cult UNIX minimalism - do one thing and one thing only.

Formerly 9 dependent modules... but who cares maybe it was a homework assignment or a joke.I don&#x27;t use NPM so maybe it doesn&#x27;t really matter aside from the level of abstraction being implemented being relatively ridiculous.However, if my build system had to go out and grab build files for every X number of basic functions I need to use, grab Y number of dependencies for those functions, run X * Y number of tests for all those dependent packages, AND then also fell apart if someone threw a tantrum and removed any one of those packages basically shutting me down for a day... then I&#x27;d question every single thing about my decisions to use that technology.[Quick Edit] Basically I&#x27;m saying &quot;Get off my lawn ya kids!&quot;

it&#x27;s a module with exactly one dependent module -- by the same author. Daily WTF material but who cares beyond that?

&quot;This isn&#x27;t your average everyday darkness....  this is Advanced Darkness.&quot; - S. Squarepants

A fun r&#x2F;programming subthread about this package: <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;4bjss2&#x2F;an_11_line_npm_package_called_leftpad_with_only&#x2F;d19vysi" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;4bjss2&#x2F;an_11_l...</a>Those are just the three top-level dependencies. The package has 9 recursive dependencies.There&#x27;s also a nice table explaining how a package called &quot;is-positive&quot; managed to reach version 3.1.0.

And 54 people found it a worthwhile package to install _this week alone_.

Well a bunch of standard libraries have sum defined, right?JavaScript has suffered from a lack of a standard library for a while. Having a small package like this means that (in theory) everyone is using the same bug free version of summing instead of writing their own.Honestly having JS start building a standard library at this point would be wonderful.

I&#x27;m thinking that someone wanted to learn about building and publishing a package and the ecosystem so they made this computationally trivial thing as a practical exercise.Pretty much every package management system gets cruft in it like this. Example: for a long time someone had uploaded a random Wordpress core install into Bower.

You know what&#x27;s worse?  Javascript numbers are all floating point numbers, which means integers are 53 bits long. So, you might think this library would try to address issues this can cause, but nope, this is the average statement you&#x27;d write if you didn&#x27;t know was a mantissa was and had never heard of big.js, bignumber.js, decimal.js, crunch.js or even strint (which represents integers as strings because wtf not).

This sounds like a symptom of an inadequate standard library. I do expect to be able to call &quot;average&quot; on a list of numbers without writing it myself, but I expect that to be part of the language not a 3rd party package.

Sounds like the author was aiming for something to put on his resume: e.g., &quot;Author of 25 libraries on NPM, some with more than 500K downloads.&quot; etc...

I think the scarier thing there is this line: &quot;0.0.1 is the latest of 2 releases&quot;I wonder if there will be a 3rd release with an updated averaging function.Edit: to be fair, it was an optimization from reduce to for loop [<a href="https:&#x2F;&#x2F;github.com&#x2F;bytespider&#x2F;average&#x2F;commit&#x2F;7d1e2baa8b8304d6918119874327854a70a61527" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bytespider&#x2F;average&#x2F;commit&#x2F;7d1e2baa8b8304d...</a>]

That package is, at best, average...ducks(Edit: typo)

While it demonstrates the problem of npm lacking namespaces (such that the word &quot;average&quot; is wasted on such a trivial implementation)...it doesn&#x27;t seem anyone was using that library

Yes, but it&#x27;s MIT licensed.  We also need average_GPL to go with it.

Similarly, the `average` package on NPM is one that I came across:<a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;average" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;average</a><pre><code> var average = require(&#x27;average&#x27;);
 var result = average([2, 5, 0, 1, 25, 7, 3, 0, 0, 10]);
 
 console.log(&#x27;The average for all the values is:&#x27;, result);
</code></pre>
It&#x27;s hard to not stare at that in complete disbelief; someone thought that it was worthwhile to create a package for determining the mean of an array of numbers.

That recursive node_modules or whatever it is called was what made me hate this whole npm thing, specially because it is not centralized somewhere in my computer. 
And that means the same files a few times repeated on my drive just eating space. 
Being a Java developer I don&#x27;t understand why the approach was not more like maven.

The recursive folder structure in npm-modules was the first indication. At least Java had a single tree with com.bigco.division.application.framework.library.submodule.NIHObject.java

I&#x27;m more disappointed that it doesn&#x27;t short-circuit the operation at all. It applies all the functions, THEN it determines whether all of them passed. Even worse, it uses `every` (which does short-circuit) to determine that all the functions are, indeed, functions, but apparently the ability to use that function to determine whether every predicate passes was missed.

Lol, nice, I wrote &quot;pass-any&quot; first. I then copied the code and replaced &quot;or&quot; w&#x2F; &quot;and&quot; to create &quot;pass-all&quot;.I will probably have go back and change this now that I know about it. In general though, not gonna a lie, I am not very concerned about micro performance optimizations.

You should then go dive into the passAll function:<a href="https:&#x2F;&#x2F;github.com&#x2F;tjmehta&#x2F;101&#x2F;blob&#x2F;master&#x2F;pass-all.js" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;tjmehta&#x2F;101&#x2F;blob&#x2F;master&#x2F;pass-all.js</a>It’s written in such a way that every time you call...<pre><code> passAll(f1, f2, ..., fn)(args..)
</code></pre>
... there are something like 5 + 2n attribute accesses, 5 + 3n function calls, 3 + n new functions created, as well as some packing and unpacking of arguments, not including the actual application of the functions to the arguments that we care about. That’s in addition to the several functions defined in the dependent submodules, which you only have to pay for constructing once.[From my quick eyeball count. These numbers could be a bit off.]

The same could be said for your post. When people ask why commenting on message boards is terrible, show them this.If you don&#x27;t want to write modules this way, don&#x27;t. Nothing about javascript requires that you even read articles about modules that you don&#x27;t want to use. Or read articles and then follow up by posting on message boards about articles about modules you aren&#x27;t going to use.Bang some code out instead. Your opinion of javascript is about as valuable as the opinion of the person who wrote the modules.

It really is the fault of the language that something this fundamentally horrible is allowed to exist in itself.When people ask why Javascript is terrible, show them this.

Also it is a lot easier to get it wrong in JS. Is it null? Is it undefined? Is it bird? Is it a plane? No it&#x27;s a string!(but sometimes a number). Good programming languages make it easy to write is negative e.g. isNegative = (&lt;0) where implicitly by the 0 and &lt; it will take a Num and return a bool and this is type checked at compile time.

This is more a reflection of how bad the JS language is than anything. Real programming languages have means of standardizing the most common UX and simple patterns into a standard library. Javascript is a consortium hell that never gets updated sufficiently, and has no good standard library, so NPM basically replaces the standard library with a thousand micropackages.

But this doesn&#x27;t address the author&#x27;s point that each module, each dependency is an additional point of failure.

The simple rebuttal to that is that modules that are collections of small functions are easy to reason about as well, and don&#x27;t the downside of increasing the metadata management to useful function ratio nearly as much.  Why have just an average (mean) function, when it makes sense to provide a median and mode as well?  Even then, you might find that there&#x27;s a bunch of extra math operations that are useful, and you might want to include some of those.

You&#x27;d have a good point, if all of those tiny but probably useful modules were given the use you&#x27;re describing.Discoverability though is so poor that most of those modules are most likely just used by the author and the author&#x27;s co-workers.If a typical npm user writes hundreds of packages, how the hell am I supposed to make use of them, when I can&#x27;t even find them? Npm&#x27;s search is horrendous, and is far from useful when trying to get to &quot;the best&#x2F;most supported module that does X&quot; (assuming that random programmers rely on popularity to make their choice, which in itself is another problem...).

I don&#x27;t see how your linked comment brings more to the table than the basic arguments for code reuse.But naturally, with any code reuse there&#x27;s a benefit and a cost to instance of internal or external reuse.The Benefits for external reuse include ideal reliability as your describe as well as not having to create the code. The costs for external reuse include having your code tied to not just an external object but also the individuals and organizations creating that object.I think that means that unless someone takes their hundreds of modules from the same person or organization and is capable of monitoring that person, that someone is incorporating a layer of risk to their code that they don&#x27;t anticipate at all.

They do NOT encourage code re-use because the effort required to understand your need, refrain from writing code, and hunt down a module in npm, far outweighs the effort to just write the code and stick it in your in-house utils library.

Just sugar-coated kool aid I&#x27;m hearing. Community benefits? First of all, I&#x27;m coding to get paid and this recent madness proved that JS ecosystem is semi-garbage. Back to the original question - do people really can&#x27;t program that they need packages like left-pad or is-integer which had their own dependencies? Before writing those cool toolchains (which would likely work in a specific machine with a specific setting with all the real world testing the community has) can we at least pretend that we know the computer science basics?

Small modules are easy to reason aboutYes they are, in the same way that a book in which every page consists of a single word is easier to understand than one with more content per page.By focusing on the small-scale complexity to such an extreme, you&#x27;ve managed to make the whole system much harder to understand, and understanding the big picture is vital to things like debugging and making systems which are efficient overall.IMHO this hyperabstraction and hypermodularisation (I just made these terms up, but I think they should be used more) is a symptom of a community that has mainly abandoned real thought and replaced it with dogmatic cargo-cult adherence to &quot;best practices&quot; which they think will somehow magically make their software awesome if taken to extremes. It&#x27;s easy to see how advice like &quot;keep functions short&quot; and &quot;don&#x27;t implement anything yourself&quot; could lead to such absurdity when taken to their logical conclusions. The same mentality with &quot;more OOP is better&quot; is what lead to Enterprise Java.Related article that explains this phenomenon in more detail:
<a href="http:&#x2F;&#x2F;countercomplex.blogspot.ca&#x2F;2014&#x2F;08&#x2F;the-resource-leak-bug-of-our.html" rel="nofollow">http:&#x2F;&#x2F;countercomplex.blogspot.ca&#x2F;2014&#x2F;08&#x2F;the-resource-leak-...</a>

&gt;TL;DR: Small modules are easy to reason about, and encourage code reuse and sharing across the entire community. How does that even remotely applies to the &quot;is positive integer&quot; test, and even more so to &quot;it&#x27;s positive&quot; and &quot;it&#x27;s integer&quot;?What&#x27;s next? is-bigger-than-5? word-starts-with-capital-letter? add-1-to-a-number?

That argument sounds like an enterprise architect explaining why the AbstractReusableBeanFactoryGenerator is going to increase productivity.

My problem is one of productivity. There&#x27;s already a standard library, and if it&#x27;s a language I&#x27;ve been using for a while, I probably remember most of it. I can pretty much go straight from my thought of what I want done to typing it out, much like typing English. If you force a &#x27;cache miss&#x27; and force me out of my head and into a documentation search, well, that&#x27;s going to have a significant effect on my performance. If the function is well-named, it has less of a cost in reading the code, but there&#x27;s still a cost, because what if it&#x27;s slightly different? I have a pretty good feel for the gotchas in much of the standard library of the languages I use. I have to stop and check what the gotchas of your function are.Yes, at some point the complexity cost of gluing together the standard library functions to do something becomes greater than the lookup cost of finding a function that does what I want; but I am saying that adding more functions is not costless.

author of over 600 modules and 1200 lines of javascript.

How is that superior to copypasting from a stackoverflow answer?If it&#x27;s a popular issue, lots of people had the same issue, many will be nice enough to add their edge cases and make the answer better, most will not. Same goes for contributing to a package.With a package you would be able to update when someone adds an edge case, but it might break your existent code and that edge case may be something that is not particular to your system.If you don&#x27;t want to get too deep in the issue, you can copy paste from SO, just the same you can just add a package.If you want to understand the problem, you can read the answers, comments, etc. With the package you rely on reading code, I don&#x27;t know how well those small packages are documented but I wouldn&#x27;t count on it.The only arguments that stands are code reuse and testability. But code reuse at the cost of the complexity the dependencies add, which IMO is not worth the time it&#x27;ll take you to copy and paste some code from SO. Testability is cool but with an endless spiral of dependencies that quite often use one or more of the different (task|package|build) (managers|tools) that the node ecosystem has, I find it hard to justify adding a dependency for something trivial.

&gt; This GitHub comment by Sindre Sorhus (author of over 600 modules on npm) is my favorite writeup on the topic:<a href="https:&#x2F;&#x2F;github.com&#x2F;sindresorhus&#x2F;ama&#x2F;issues&#x2F;10#issuecomment-1.." rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;sindresorhus&#x2F;ama&#x2F;issues&#x2F;10#issuecomment-1...</a>.If anything looking at sindresorhus&#x27;s activity feed: (<a href="https:&#x2F;&#x2F;github.com&#x2F;sindresorhus" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;sindresorhus</a>) perfectly supports the author&#x27;s point. Maybe some people have so little to do that they can author or find a relevant package for every single ~10 line function they need to use in their code and then spend countless commits bumping project-versions and updating package.json files. I have no idea how they get work done though..

<pre><code> Small modules are easy to reason about
</code></pre>
They really aren&#x27;t, when I&#x27;m reading is-positive-integer(x) and wonder if 0 is positive I need to hunt down the definition of positive through two packages and as many files. And it gets wrose if both your code and one of your dependencies required &#x27;is-positive-integer&#x27; and I have to also figure out which version each part of the code base is using.If you had written (x &gt; 0) I would have known immediately, it also wouldn&#x27;t be doing the same thing as is-positive-integer(x) but how many calls to is-positive-integer are actually correct in all the corner cases that is-positive-integer covers?And then there&#x27;s the other problem with dependencies: you are trusting some unknown internet person to not push a minor version that breaks your build because you and Dr. is-positive-integer had different definitions of &#x27;backwards compatibility&#x27;.

Why dont they put everything together and call it &quot;commons&quot; like in Java? (commons-lang, commons-io, etc).

it reminds an apt proverb: missing forest for the trees.Too many modules do not necessarily become a good thing. They may appear to get rid of complexity but in reality, you will have to face the complexity some level above and in fact, the sheer number of small modules will most probably add more complexity of themselves.

I agree with you, besides the tree-shaking (nice word btw).
It&#x27;s like NPM shaking the Christmas tree and then say &quot;Have fun cleaning up the floor&quot;. Remember that NPM is not like apt-get, where the packages are Managed for you by an expert. In NPM you have to manage the packages! And where you can&#x27;t have NPM and build dependencies, like in production, maintenance now becomes much harder!

&gt; Small modules are easy to reason aboutFlip-side: it isn&#x27;t easy to reason about a large and complicated graph of dependencies.

I&#x27;m not at all clear why this blog post is touted as evidence that the tiny modules approach is correct. I think it might be all the people after it congratulating him.&quot;It&#x27;s all about containing complexity.&quot; - this completely ignores the complexity of maintaining dependencies. The more dependencies I have the more complicated my project is to maintain.Dependencies are pieces of software managed by separate entities. They have bugs and need updates. It&#x27;s hard to keep up to date.When I update a piece of software I read the CHANGELOG, how am I expected to read the CHANGELOG for 1,000 packages?Depending on a bigger package (handled by the same entities, who write one changelog, in the same form) is more straight forward.I&#x27;m not saying this is wrong - but there&#x27;s a balance here, and you must not ignore the complexity of increasing your number of dependencies. It does make things harder.

I get that author&#x27;s point, but do you REALLY need a dependency module that tells you the type of something?That&#x27;s not a Lego block; that&#x27;s an excuse.

I think that there&#x27;s a certain wishfulness bordering on naïveté to this pursuit. We tell ourselves that we are managing complexity by having small, well-tested units that are reused by an entire community. But software complexity continues to exist. We think we are mitigating the complexity of our own software. But the complexity really just shifts to the integration of components.Anyone that has been around long enough has war stories about getting two relatively simple pieces of software working with each other. In my experience, integration problems are often the most difficult to deal with.

The alternative to small modules is not no modules at all, it&#x27;s libraries.

It&#x27;s interesting to me that people find this convincing. I find it to be complete insanity. People need their libraries, but putting everything in tiny buckets is just not working. Why aren&#x27;t people working on good utility libraries instead?There&#x27;s even some guy calling for a &quot;micro-lodash&quot;. To me, as a Python engineer, lodash [1] is already a tiny utility library.I guess it&#x27;s also about the fact that JS is a pretty bad language. That you need a one-line `isArray` dependency to `toString.call(arr) == &#x27;[object Array]&#x27;` is crazy.[1] <a href="https:&#x2F;&#x2F;lodash.com&#x2F;docs" rel="nofollow">https:&#x2F;&#x2F;lodash.com&#x2F;docs</a>

&gt; author of over 600 modules on npmNope.

The reasoning makes sense for small modules that might change in the future, but as he says himself, most of his modules are finished and will never change. That makes many arguments in his post moot and the modules should probably be snippets instead that are implemented directly.

My problem with this, as an occasional JavaScript developer, is &quot;discoverability&quot; (as many others have mentioned). If I decide I need a left-pad function, and search on NPM, how do I choose which one is best? The one with the most downloads? Not always the best indicator of quality; perhaps it&#x27;s just the oldest.Not to mention the cognitive overhead of stopping programming, going to NPM, searching&#x2F;finding&#x2F;installing the module, then reading the documentation to understand its API. Isn&#x27;t it simpler to `while (str.length &lt; endLength) str = padChar + str;`? How can there be a bug in that &quot;alternative naive inlined solution&quot;? Either it works or it doesn&#x27;t!

Small modules are also often the result of dealing with different javascript implementations over the years. I&#x27;ve recently seen a simpler version of the left pad that would not have worked on multiple Safari versions or &lt;IE6The derision is unwarranted, due to a failure in critical thinking from otherwise smart people.

Percentage of module owners who you can&#x27;t trust to not screw up their module: HRisk of indirectly hosing a project with N module owners providing dependencies: 1-((1-H)^N)Let&#x27;s say H is very small, like 0.05% of module owners being the type who&#x27;d hose their own packages.3 module owners: 0.15% chance your own project gets hosed30 module owners: 1.49% chance your own project gets hosed300 module owners: 13.93% chance your own project gets hosedKeep in mind it&#x27;s not just your dependencies, but your entire dependency chain. And if you think a module owner might hose some modules but not others, maybe H is actually the number of modules in which case 300 starts getting pretty attainable.Upshot:Not everyone is trustworthy enough to hang your project on. The more packages you include, the more risk you incur. And the more module owners you include, definitely more risk.The micromodule ecosystem is wonderful for all the reasons described, but it&#x27;s terrible for optimizing against dependency risk.Takeaways:Host your own packages. That makes you the module owner for the purposes of your dependency chain.If you&#x27;re not going to do that, don&#x27;t use modules dynamically from module owners you don&#x27;t trust directly with the success of your project.I love collaborative ecosystems, but some people suck and some perfectly non-sucky people make sucky decisions, at least from your perspective. The ecosystem has to accommodate that. Trust is great...in moderation.

This comes up a lot when people discuss anything related to npm modules. It&#x27;s easy to simply dismiss these trivial one-line modules as &quot;insanity&quot; and move on, but there&#x27;s actually plenty of good reasons as to why many prefer to work with multiple small modules in this manner. This GitHub comment by Sindre Sorhus (author of over 600 modules on npm) is my favorite writeup on the topic:<a href="https:&#x2F;&#x2F;github.com&#x2F;sindresorhus&#x2F;ama&#x2F;issues&#x2F;10#issuecomment-117766328" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;sindresorhus&#x2F;ama&#x2F;issues&#x2F;10#issuecomment-1...</a>TL;DR: Small modules are easy to reason about, and encourage code reuse and sharing across the entire community. This allows these small modules to get a tremendous amount of real world testing under all sorts of use cases, which can uncover many corner cases that an alternative naive inlined solution would never have covered (until it shows up as a bug in production). The entire community benefits from the collective testing and improvements made to these modules.I also wanted to add that widespread use of these small modules over inlining everything makes the new module-level tree-shaking algorithms (that have been gaining traction since the advent of ES6 modules) much more effective in reducing overall code size, which is an important consideration in production web applications.

YES YES YES!In all the debate about this, why is the trust-dependency-fuck-show not getting more attention?Every dependency you take is another degree of trust in someone else not getting compromised then suddenly finding all sorts of horribleness making it into your production environment.It beggars belief!

It&#x27;s a fucking nightmare, is what it is.I wanted to use a javascript tool that would make my life easier, and when I looked at the npm dependency tree it had 200+ dependencies in total.If I used that javascript tool, I&#x27;d be trusting hundreds of strangers, lots of which had absolutely no clout in github (low number of stars, single contributor projects) with my stuff.And not just them, I&#x27;d be trusting that no one steals their github credentials and commits something harmful (again, these projects are not very popular).It doesn&#x27;t help that npm doesn&#x27;t (AFAIK) implement code signing for packages which at least would let me manage who I choose to trust

With how weird javascript can be about numbers, it actually didn&#x27;t surprise me that your module existed.

&quot;DRY is the most obvious one, but one that may be less obvious is for better testing.&quot;Isn&#x27;t that why we just write functions? Turning simple functions into entire modules just adds an unnecessary level of abstraction that helps nobody.

Two points:- Breaking out is-positive-integer hasn&#x27;t reduced the number of paths to test. You have not gained anything, you&#x27;ve added overhead.- 100% test coverage is rarely a good thing. It is required for safety critical areas like avionics. I can guarantee that your JS code is not making into any safety critical environment!

That&#x27;s interesting. JavaScript has enough quirks to warrant an is-positive-integer module.

Just to pick at a nit with you, it&#x27;s a little meaningless to say &quot;100% test coverage&quot;, without specifying whether you&#x27;re talking about line coverage, branch coverage, path coverage...This is especially true for one-liner modules in js, where any test at all might let you claim 100% statement coverage, without accounting for branches or loops within method calls.

It would be really, really great if this function was not in its own module, but was part of a larger library in which all such functions of related modules were captured, without the (cognitive and other) overhead of the separate packaging.

Actually, thats a good reason to use trivial functions like the one described. Hopefully the author has discovered all of the quirks in Javascript that might affect this. It will likely be a lot more tested than any version I would write.As someone who spends 80% on the back end, I often get bit on the ass from JavaScripts quirks when I need to add some front end stuff.

Author of &quot;is-positive-integer&quot; here. I will admit the implementation is pretty funny, but I move-out all single-purpose utils out of projects to modules for a bunch of reasons. DRY is the most obvious one, but one that may be less obvious is for better testing.I move out modules so I can write really nice tests for the independent of the projects I am using them in. Also, I tend to write projects w&#x2F; 100% test coverage, breaking out utils allows me to test projects easier and faster.Also note, the implementation of this module changed a few times today. With it being open source and having the collaboration of other engineers, we ended up with a very performant version, and discovered interesting quirks about &quot;safe integers&quot; in JS.

DRY taken to the dogmatic extreme where everything is made up and the github stars are the only thing that matters.This article touches on things that are wrong in the javascript culture. I always had this nagging feeling when working with NPM, this article brings it to light. For what it&#x27;s worth I never felt this while writing Ruby, C# or Go.It&#x27;s the -culture- that needs to change here, not the tools.

You create unit tested functions and expose them to client code with a factory pattern, how is that so ridiculous?

This implementation reads almost as parody, although I don&#x27;t suspect that the author meant it as such. If you didn&#x27;t have a sense of what lurked behind the abstraction, it would be kinda beautiful.

Yeah, there are a few shitty examples on npm. It&#x27;s an open system and anyone can upload anything. The market speaks on how valuable those are. Cherry picking poor modules says nothing about the rest.Plus, if you think that&#x27;s too small, write your own broader module that does a bunch of stuff. If people find it valuable, they&#x27;ll use it. If they find it more valuable than a bunch of smaller modules, you&#x27;ll get 10,000 downloads and they&#x27;ll get 10.The module you roundly ridicule has had 86 downloads in the last month, 53 of which were today (at the time of this writing). I imagine most of those 53 were after you posted. So that&#x27;s 40 downloads in a month, as compared to the express framework which has had 5,653,990 downloads in the last month.The wailing and gnashing of teeth over this module is ridiculous.

I can&#x27;t stop laughing. I think you have to admire the elegance of the concept as performance art though: this is cheap insanity. In fact, I&#x27;ve got to hand it to them, this is the most fun I&#x27;ve had looking at something programming related in a while. I recall the opening lines of SICP,&gt; I think that it&#x27;s extraordinarily important that we in computer science keep fun in computing. When it started out, it was an awful lot of fun. Of course, the paying customers got shafted every now and then, and after a while we began to take their complaints seriously. We began to feel as if we really were responsible for the successful, error-free perfect use of these machines. I don&#x27;t think we are. I think we&#x27;re responsible for stretching them, setting them off in new directions, and keeping fun in the house. I hope the field of computer science never loses its sense of fun. Above all, I hope we don&#x27;t become missionaries. Don&#x27;t feel as if you&#x27;re Bible salesmen. The world has too many of those already. What you know about computing other people will learn. Don&#x27;t feel as if the key to successful computing is only in your hands. What&#x27;s in your hands, I think and hope, is intelligence: the ability to see the machine as more than when you were first led up to it, that you can make it more.Quoted in The Structure and Interpretation of Computer Programs by Hal Abelson, Gerald Jay Sussman and Julie Sussman (McGraw-Hill, 2nd edition, 1996).

Seems like the answer is &quot;none&quot; by default, from <a href="https:&#x2F;&#x2F;docs.npmjs.com&#x2F;misc&#x2F;scripts#user" rel="nofollow">https:&#x2F;&#x2F;docs.npmjs.com&#x2F;misc&#x2F;scripts#user</a>&gt; If npm was invoked with root privileges, then it will change the uid to the user account or uid specified by the user config, which defaults to nobody. Set the unsafe-perm flag to run scripts with root privileges.

What I want to know is how many systems does the author of is-positive-integer have implicit root access to?Sounds to me like publishing oneliners on NPM is a trivial way to build a botnet.

I have an extremely hard time believing this module is not a joke, ditto for many other NPM modules.

I end up spending most of my working life working on other peoples code, rather than new features I end up debugging and fixing bad code. (I actually rather like it)The majority of code I have ever seen is awful (20 years across large + small companies) but that is why I am hired to fix awful code so I am skewed. The amount of times I have seen people implement something simple, in a convoluted error prone was is unbelievable.I know this seems ridiculous but when you see time and time again how people fail to do the simplest things it seems like a good idea.

&gt; They&#x27;ve already taken it to an entirely different level of insanity.Why is this insane? What alternatives would be better?

I had several arguments about JS and I was shocked how many developers consider this platform great. I am not sure why these extremely bad practices are defended by devs, what are they getting out of it? I am only hoping we are moving towards more sensible development environment, there are many of them with better best practices and more sane libraries.

I can&#x27;t decide what&#x27;s crazier to me: that such a package exists, or that JavaScript is such a ridiculously bad language that an &quot;is positive integer&quot; function is non-trivial to write.

Sure, because just writing<pre><code> isPositive = (x) =&gt; +x === x &amp;&amp; x &gt; 0 
</code></pre>
is boring. Need more requires to require the requires...Keep in mind though that absolutely not all JS programmers are like that. Not everyone wants to be an aforementioned Dick-from-a-mountain.

Holy moly-- is-positive-integer&#x2F;index.js:<pre><code> var passAll = require(&#x27;101&#x2F;pass-all&#x27;)
 var isPositive = require(&#x27;is-positive&#x27;)
 var isInteger = require(&#x27;is-integer&#x27;)

 module.exports = passAll(isPositive, isInteger)
</code></pre>
I retract my previous statements that Javascript programmers are going down the same enterprise-y mess that Java programmers went down a decade ago.They&#x27;ve already taken it to an entirely different level of insanity.

That&#x27;s true, I don&#x27;t. But if your deadline is too tight to do it right, maybe you need to reevaluate your project plan.I mean, I can certainly see using more dependencies than I&#x27;m using. Mail is a great example of something that probably should be handled by dedicated, well-tested code. But to carelessly dump piles of third-party dependencies in your project to save a few minutes, as talked about in this article... just crazy.

Spoken like someone who doesn&#x27;t have a tight deadline.

Spoken like someone who isn&#x27;t on a tight deadline.

My current programming project, my goal has been to do as much in-app as possible. Does that mean I&#x27;m more likely to have bugs in my own code? Yes. But I&#x27;ve learned a ton doing it, and I know that my code doesn&#x27;t have a giant monster of bloat hidden behind some random dependency somewhere. And yeah, that means when I wanted to handle email, I learned a heck of a lot about how programs handle email. Did it take more time? Yup. Education is time well spent.I&#x27;ve got two dependencies besides the basic framework my project is built on: A scheduling engine, and a database interface. I eventually hope to factor out both.

Yeah but you&#x27;re loading an entire library to use one function?

The latest version of lodash (4.0.0) doesn&#x27;t support IE 8, so you would need to polyfill isArray() yourself or use a pre-modern lodash version.

Do you support IE 8? If not, why not use the one provided by the language, Array.isArray()?

Nearly everyone has had it drilled into them the &quot;Don&#x27;t reinvent the wheel.&quot; nonsense for better or worse.I use lodash in almost every javascript project I start, big or small because it makes my life easier.I&#x27;d rather use the lodash isArray than roll my own.<a href="https:&#x2F;&#x2F;lodash.com&#x2F;docs#isArray" rel="nofollow">https:&#x2F;&#x2F;lodash.com&#x2F;docs#isArray</a>

What concerns me here is that so many packages took on a dependency for a simple left padding string function, rather than taking 2 minutes to write such a basic function themselves.It takes more than two minutes. That little module has a test suite, if you&#x27;re including it then you have some assurance it does what it says it does. If you write it you&#x27;ve got to worry about whether it works or not.

I don&#x27;t agree with the explosion of micro-modules. There&#x27;s a reason the vast majority of languages doesn&#x27;t have them, at least not at function level.IMO in the Javascript world they&#x27;re only there in order to minimize script size for front end work. See lodash &amp; lodash-something1 &#x2F; lodash-something2 &#x2F; ..., where there&#x27;s an option of using the whole module or just including 1-function long scripts, precisely to avoid the script size issue.Is there a solution for this? I know that the Google Closure compiler can remove dead code, ergo making inclusion of large modules less costly in terms of code size. Am I missing some ES6 feature that also helps with this?

JavaScript much to my dismay has no sprintf. It&#x27;s one of the most annoying omissions ever for server side work.

Uh, no Left Padding is NOT built-in in JavaScript. The proposal to add `String.prototype.padLeft()` was just added to ECMAScript 2016.JavaScript had a very minimal standard library, it&#x27;s pretty asinine of you to compare it to C or any other language with a pretty extensive standard library.

I think there&#x27;s two points related to that:1) JS is unique in that it is delivered over the wire, so there is a benefit in having micro-modules instead of a bigger &quot;string helpers&quot; module. Things like webpack are changing that now (you can require lodash, and use only lodash.padStart).2) JS&#x27;s &quot;standard&quot; library is so small, because it&#x27;s the intersection of all of the browser implementations of JS dating as far back as you care to support. As pointed out in sibling, a proposal for padLeft is included in ECMA2016. But we&#x27;ll still need Left-Pad for years after it&#x27;s adopted.

No, no, noLeft padding is (almost in all languages) built-in, even C can do it with printf (edited)The problem is not having a library that offers that, but having this micro-module thing as a whole NPM module. No other language does that.If it was inside a string helpers, that&#x27;s great.But don&#x27;t make me one single module for just left-padding (or is-integer-number)

Wow, I feel like I could have written this. Back when I used Python, I had a folder full of functions I would copy-paste between my projects. (And maybe some of the projects contained unit-tests for the function. I didn&#x27;t always keep those tests in sync.) Updating them was a pain because inevitably each one would get slightly modified over time in each project separately. Eventually, I bundled all of them into a bundle of completely unrelated utility functions in a folder on my computer somewhere, and I would import the folder with an absolute path. Sharing the code I wrote was a pain because of how much it referenced files on my local computer outside of the project. I never considered publishing my utility module because all of the stuff was completely unrelated. I&#x27;d rather publish nothing than a horrifying random amalgram that no single project of mine was even related to all of the subject matter present in it.With npm and the popularity of small modules, it was obvious that I could just cheaply publish each of my utility functions as separate modules. Some of them are about a few dozen lines, but have hundreds of lines of tests and have had significant bugfixes that I am very happy that I haven&#x27;t had to manually port to dozens of projects. I don&#x27;t miss copy-pasting code across projects, no matter how many claim I&#x27;ve &quot;forgotten how to program&quot;.

What I see is that a module has a non-zero overhead in complexity in itself. That is, ten 10 line modules and twenty 5 line modules do not yield the same complexity. The modules themselves have a complexity overhead associated, and submodules have their own complexity overhead associated, albeit smaller than first party modules. That complexity is easily seen from the recent situation of unpublishing modules, which resulting in modules multiple steps removed having problems building.So, when I read &quot;It doesn&#x27;t matter if the module is one line or hundreds.&quot; I call bullshit. There is overhead, it&#x27;s usually just fairly small (at may event begin to rival the gains from using a module at that level), but that small amount adds up. Once you&#x27;ve had to deal with a dependency graph that&#x27;s 10 levels deep and contains hundreds or thousands of modules, that small extra complexity imposed by using a module is no longer in total, and comes at a real cost, as we&#x27;ve just seen.Other module ecosystems have gone through some of the same problems. There was a movement in Perl&#x2F;CPAN a few years back to supply smaller, more tightly focused modules a while back, to combat the sprawling dependencies that were popping up. The module names were generally suffixed with &quot;Tiny&quot;[1] and the goals where multiple:- Where possible, clean up APIs where consensus had generally been built over what the most convenient usage idioms were.- Try to eliminate or reduce non-core dependencies where possible.- Try to keep the modules themselves and their scope fairly small.- Remove features in comparison to the &quot;everything included&quot; competitor modules.This has yielded quite a few very useful and strong modules that are commonly includes in any project. They aren&#x27;t always tiny, but they attack their problem space efficiently and concisely. Even so, I&#x27;m not sure there&#x27;s ever a module that&#x27;s a single line of code (or less than 10, given the required statements to namespace, etc), as the point is to serve a problem, not an action.1: <a href="https:&#x2F;&#x2F;metacpan.org&#x2F;search?size=20&amp;q=%3A%3Atiny&amp;search_type=modules" rel="nofollow">https:&#x2F;&#x2F;metacpan.org&#x2F;search?size=20&amp;q=%3A%3Atiny&amp;search_type...</a>

Another interesting argument for micro-modules:<a href="https:&#x2F;&#x2F;github.com&#x2F;sindresorhus&#x2F;ama&#x2F;issues&#x2F;10#issuecomment-117766328" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;sindresorhus&#x2F;ama&#x2F;issues&#x2F;10#issuecomment-1...</a>

Padding a string is a one liner. I&#x27;m perfectly happy to write it, test it, convince myself that it works, and then forget about it and just use it.

OR: you depend on a specific version of the library, that you know that works, and you have none of those problems.

&gt; If you add a dependency for just a few lines of code, you&#x27;re making a way bigger commitment than if you&#x27;d just copy&#x2F;pasted the code and maintained it yourself.This is a problem with NPM, not with dependencies. With different package management systems with stable builds and lockfiles, then you pin to a specific version and there is no way upstream can cause problems. A lockfile is a pure win over vendoring.

Maintaining a dependency on a library should be much less effort than maintaining 17 lines of code. If it isn&#x27;t that&#x27;s a deficiency in your dependency infrastructure.

&gt; every line of code I write myself is a commitmentThat&#x27;s true. However:Every dependency you add to your project is also a commitment.When you add a dependency, you&#x27;re committing to deal with the fallout if the library you&#x27;re pulling in gets stale, or gets taken over by an incompetent dev, or conflicts with something else you&#x27;re using, or just plain disappears. If you add a dependency for just a few lines of code, you&#x27;re making a way bigger commitment than if you&#x27;d just copy&#x2F;pasted the code and maintained it yourself. That&#x27;s why so many people are shaking our heads at a 17-line dependency. It&#x27;s way more risk than it&#x27;s worth. If you need a better stdlib for your language (some of us write PHP and feel your pain) then find one library that fills in the gaps and use that.

I agree with the points you&#x27;ve made, but I would also posit that adding a dependency using this mutable package manager is making a commitment to maintain the integrity of that dependency, which is arguably more work than maintaining the handful of lines of code.

What&#x27;s wrong with copy&#x2F;paste?Why do you need an external dependency on something so small?

Agreed as well. In fact, I would posit that this wasn&#x27;t even really a problem until npm@3 came out and made installing dependencies far, far slower. Yet it was necessary; a standard project using babel + webpack installs nearly 300MB (!!!) of dependencies under npm@2, and about 120MB under npm@3. Both are unacceptable, but at least npm3 helps.I want to plug ied (<a href="https:&#x2F;&#x2F;github.com&#x2F;alexanderGugel&#x2F;ied" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;alexanderGugel&#x2F;ied</a>) here, which both installs about 5x faster than npm@2, yet deduplicates as well as npm@3.

Completely agree here - the problem isn&#x27;t micro-modules. It&#x27;s partly just a lacking standard library for javascript and largely just exposing issues in npm that the community was pretty ignorant of until just now.The whole &quot;amaga, it&#x27;s a whole package for just ten lines of code&quot; is just elitism. Given the number of downloads on things like left-pad, it&#x27;s clearly useful code.

I wouldn&#x27;t mind so much if these micro-modules were written in a style of thoroughness; heavily commented, heavily documented with pre-conditions, post-conditions and all imaginable inputs and outputs explicitly anticipated and formally reasoned about. I don&#x27;t mind over-engineering when it comes to quality assurance.Looking at that left-pad module though - no comments, abbreviated variable names, no documentation except a readme listing the minimally intended usage examples. This is not good enough, in my opinion, to upload to a public repository with the objective that other people will use it. It is indistinguishable from something one could throw up in a couple of minutes; I certainly have no reason to believe that the future evolution of this code will conform to any &quot;expectation&quot; or honour any &quot;commitment&quot; that I might have hopefully ascribed to it.[EDIT: I&#x27;ve just noticed that there are a handful of tests as well. I wouldn&#x27;t exactly call it &quot;well tested&quot;, as said elsewhere in this thread, but it&#x27;s still more than I gave it credit for. Hopefully my general point still stands.]The benefits of reusing other people&#x27;s code, to a code reuser, are supposed to be something like:(a) It&#x27;ll increase the quality of my program to reuse this code - the writer already hardened and polished this function to a greater extent than I would be bothered to do myself if I tried right now(b) It&#x27;ll save me time to reuse this code - with the support of appropriate documentation, I shouldn&#x27;t need to read the code myself, yet still be able to use it correctly and safely.Neither of those things are true for this module. It&#x27;s not that the module is small, it&#x27;s that it is bad.(True that npm&#x27;s mutability is a problem too - this is just a side-track.)

I&#x27;d say you&#x27;re playing fast and loose with the term &quot;edge case&quot; there. I call that a bugfix, for a feature that does not work.

You&#x27;re just trading in the complexity of the code you&#x27;d have to write for the delayed complexity of dealing with dependency issues down the line. It&#x27;s a waste of a trade off for tiny things like this.

It doesn&#x27;t handle edge cases, it doesn&#x27;t perform well and it isn&#x27;t well tested. There is also no documentation. Obviously 30 seconds wasn&#x27;t enough for you to verify anything at all about this module (namely that it&#x27;s complete garbage).And just because some random guy didn&#x27;t get something as trivial as this right the first time, doesn&#x27;t mean nobody else can. Also the de facto standard library lodash already has padding utilities, made by people who have a proven track record.

Completely agree.Combining this with isomorphic code, cross-browser development and micro-services.I even wrote a blog post couple of days ago about it [1].1 : <a href="http:&#x2F;&#x2F;www.drinchev.com&#x2F;blog&#x2F;increase-your-dependencies&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.drinchev.com&#x2F;blog&#x2F;increase-your-dependencies&#x2F;</a>

Counter-argument:A good micro-module removes complexity. It has one simple purpose, is tested, and you can read the code yourself in less than 30 seconds to know what&#x27;s happening.Take left-pad, for example. Super simple function, 1 minute to write, right? Yes.But check out this PR that fixes an edge case: <a href="https:&#x2F;&#x2F;github.com&#x2F;azer&#x2F;left-pad&#x2F;pull&#x2F;1" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;azer&#x2F;left-pad&#x2F;pull&#x2F;1</a>The fact of the matter is: every line of code I write myself is a commitment: more to keep in mind, more to test, more to worry about.If I can read left-pad&#x27;s code in 30 seconds, know it&#x27;s more likely to handle edge cases, and not have to write it myself, I&#x27;m happy.The fault in this left-pad drama is not &quot;people using micro-modules&quot;. The fault is in npm itself: all of this drama happened only because npm is mutable. We should focus on fixing that.

This is acceptable because web developers expect a certain level of coddling.  Many developers are quick to defend this insanity because they simply cannot see their own level of entitlement.

As a dot net developer I avoid adding packages and references at all costs due to all of these same reasons. Usually for something simple like this left pad example, I just copy the code and put it in to my project in some sort of class of helper functions or extension methods.Seems like a lot of these basic Javascript functions need to be built in to javascript&#x2F;node itself or consolidated down to a single package of common core functions that extend Javascript. Like padding, is array, etc. As others mentioned, these are fundamental things in other languages.

Considering the fact that Excel had to run on multiple versions of Windows and also run on the Apple Mac I can understand why they would hate hidden dependencies.I&#x27;ve experienced the joy of trying to make sure Win32 code runs on Windows 3.11 (with Win32s), Windows 95, Windows 98, Windows Me, NT, 2000 and XP.Generally it all works, but sure enough there are times when a small code change breaks one or more of those platforms.Luckily these days things are much better as Win32 is a lot more consistent.

Relevant:&#x27;&quot;The Excel development team will never accept it,&quot; he said. &quot;You know their motto? &#x27;Find the dependencies -- and eliminate them.&#x27; They&#x27;ll never go for something with so many dependencies.&quot;In-ter-est-ing. I hadn&#x27;t known that. I guess that explained why Excel had its own C compiler.&#x27;<a href="http:&#x2F;&#x2F;www.joelonsoftware.com&#x2F;articles&#x2F;fog0000000007.html" rel="nofollow">http:&#x2F;&#x2F;www.joelonsoftware.com&#x2F;articles&#x2F;fog0000000007.html</a>

Only if your modules are little more than textual inclusion and perhaps a mechanism to deal with name clashes. ML style modules are way more substantial than that, they can be used as units of abstraction.

This is just more evidence that the unit of code is a function, not a module.Eventually, given a pure enough language, every &quot;package&quot; could contain only a single function, and every function in a project could be published as an independently reusable unit.

It beats the alternative - pulling in some huge package with lots of little functions, all of which end up in the output. At least you&#x27;re not loading huge amounts of unreachable code into the running system.In languages with linkers, the better linkers would discard all unreachable functions. Then came DLLs. Use one function in a DLL&#x2F;.so, and the whole thing has to be loaded. Go and Rust are usually statically linked, reflecting the fact that pulling in big DLLs was usually a lose. You rarely have two different programs on the same machine using the same DLLs, except for some standard low-level ones such as the C library.

I&#x27;m not sure if you&#x27;re saying this of my comment or the OP, but I code professionally every day in this style and it&#x27;s working out just fine. And the smaller my modules get the better it seems to work.

I wish I could say you were joking.  At best it comes off as ivory tower idealism, at worst the complete naivete of someone who doesnt code.

I don&#x27;t know why you were downvoted, but I agree with you 100%.Pure functions are indeed a good target for modularity and deserve proper documention and proper testing, at the very least.For the readers of this comment:* How many functions did you not commented last time you wrote some code?* How many functions do you leave untested?* How many functions did you wrote more than once?* How many &quot;trivial&quot; functions did you wrote that actually took you 3 hours, because it&#x27;s actually tricky, so you checked other implementations and tried to wrap your mind around it.Check haskell&#x27;s hoogle to a small sample of this concept.

What if it was well-tested?What if it was well-typed?What if it was awesomely documented?Would that be ok? I&#x27;m asking, because a lot of the discussion in this post comes a single simple function being a dependency.

a) I think that&#x27;s a fine number of tests for a module this simple, which is itself an argument in favor of small modules. And I think it&#x27;s four more assertions than anyone implementing this inline in a project would have.b) The details of this particular project are orthogonal to the philosophy of small modules generally. Whether or not this module is well implemented or well tested has no real relation to whether or not it is a good idea to compose tiny modules.

You are assuming well tested is referring to unit tests, rather than the wealth of developers depending on and running it in their projects daily.Don&#x27;t forget how many different targets there are for JavaScript, even if you had a test environment with limitless budget, it wouldn&#x27;t compare to having a popular package on NPM.

&gt; Why would I implement left-pad myself when there is already a well-tested implementation that I can install?You call 4 basic assertions &quot;well-tested&quot;?<a href="https:&#x2F;&#x2F;github.com&#x2F;azer&#x2F;left-pad&#x2F;blob&#x2F;master&#x2F;test.js" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;azer&#x2F;left-pad&#x2F;blob&#x2F;master&#x2F;test.js</a>

He wouldn&#x27;t put that small function in a package (or even a  separate file) though.

&quot;Sometimes, the elegant implementation is just a function. Not a method. Not a class. Not a framework. Just a function.&quot;--John Carmack

Everything in this article is categorically wrong and antithetical to every principle of good programming ever articulated. The only problem here, as others have already noted, is that NPM allows people to delete published packages.Small modules are not evidence of a problem, and they certainly aren&#x27;t evidence of an inability to implement these things on the part of the people depending on them. Why would I implement left-pad myself when there is already a well-tested implementation that I can install? Building up an ecosystem of tiny abstractions, bit by bit, iteratively and evolutionarily, is how we get robust, well-designed complex systems. We don&#x27;t get there by everyone reinventing the left-pad function to sate some misplaced appetite for self-reliance.The author seems to make some arbitrary distinction between things that are &#x27;large enough&#x27; to be packaged and &#x27;pure functions&#x27; which are &#x27;too small&#x27; to be their own modules, and I just couldn&#x27;t disagree more. Tiny, pure functions are ideal modules. They facilitate the greatest degree of re-use, most clearly articulate what they ought to be used for, and stateless things are, in general, more composable than stateful things. There is no better unit of re-use than a tiny, pure function.

It does seem pretty insane, but how many of these are polyfills?

Personally, it&#x27;s not about the &#x27;original&#x27; developer pulling out, but about the simple question: who or what do you trust?1. The developer,
2. The content distributor,
3. The code (by git SHA ref perhaps),
4. The contract of the code (using formal verification),
5. The legal contract with the code supplier.And if you trust 1, do you expect of him to sign the stable releases using GPG tags?All the focus on OSS nowadays seems to be on 1, but as professional engineers, shouldn&#x27;t we focus more on 4 and 5?

I know I wasn&#x27;t interested in doing any JavaScript until they started modularizing it and npm was that on crack. Possibly once the kids had their shiny new npm, some went mad with power and took it too far. Take the good with the bad though as the JavaScript language is known for.

The OP is deliberately talking about a completely different issue that just happened to be spawned from the recent drama.He is talking about learning to code vs asking google for implementations of even the most trivial things and about what a useful library is.

This is a non-issue and taking focus away from the real issue. The issue is the security hole that NPM opens up when a namespace can be grabbed up by anyone if the original developer pulls out.

Functions Are Not PackagesCracked me up :D

Committed five hours ago: <a href="https:&#x2F;&#x2F;github.com&#x2F;lydell&#x2F;line-numbers&#x2F;commit&#x2F;711f6ad0eb1771341aecb59d83f139a24d862dba" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;lydell&#x2F;line-numbers&#x2F;commit&#x2F;711f6ad0eb1771...</a>This mess appears to have convinced the author of that.

This is in the description of line-numbers:DEPRECATED. This is a rather silly package that I do not recommend using. It&#x27;s easier to copy the ~20 lines of code of this package and customize that code, rather than downloading and learning how to use this package.

About 2&#x2F;3 of those (1.7M) were from babel-code-frame, which is a core dependency of babel:<a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;babel-code-frame" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;babel-code-frame</a>And the fix was just to drop the functionality and inline the function as a no-op:<a href="https:&#x2F;&#x2F;github.com&#x2F;babel&#x2F;babel&#x2F;commit&#x2F;09287643c712bcd203bbd6f2f9fa7a9ae54026b8" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;babel&#x2F;babel&#x2F;commit&#x2F;09287643c712bcd203bbd6...</a>

In the case of left-pad, 2538464 of its 2550569 downloads last month are attributed to dependents of the line-numbers package (<a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;line-numbers" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;line-numbers</a>). So it would appear that relatively few people directly rely on left-pad, which highlights the importance of vetting the dependencies of dependencies.

This is from a client-side web dev perspective:I&#x27;m hoping that proper support for ES6 modules to enable tree-shaking bundle builds (in the short term), and HTTP2 with client support for modules (in the long term), will allow us to head towards a world where we converge around a handful of large utility libraries.In theory, tiny dependencies was supposed to allow us to only include code we actually needed in our bundled code. Bu the reality is that everyone uses different tiny dependencies for solving the same problem. So you end up with enormous bundles made up of different solutions to the same tiny problems.

When I was prevented from upgrading Xcode&#x2F;Swift for a project last year because of podfile dependencies, that cemented in my mind that every time I include a dependency, I&#x27;m putting myself at risk.If I can spend half a day writing the code myself, I will -- because I know it will prevent headaches down the road. Yes, yes, I know any code I write adds the probability of bugs down the road. But at least the roadblock would be of my own doing, and not dependent on if&#x2F;when the package maintainer upgrades their stuff.

One of the things I&#x27;ve enjoyed the most while programming in Go for the past couple years is the standard library and how much the Go community emphasizes keeping external dependencies to a minimum. For most projects I find myself using few if any external packages.Now of course there are times you&#x27;ll want to reach for a library, say for something like an http router, and up until recently the dependency management side of Go has been lacking. But when a pattern or library arises that many find useful the core team is open to pulling that in to the standard library if a strong enough case is made, for example in the context package (<a href="https:&#x2F;&#x2F;github.com&#x2F;golang&#x2F;go&#x2F;issues&#x2F;14660" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;golang&#x2F;go&#x2F;issues&#x2F;14660</a>).

Well put. When a hammer requires endless accessories to drive a nail, is it the right tool for the job?

To me, this looks like a symptom not of bad programmers but of a terrible standard library.

This was probably grotesquely naive of me, but I literally had no idea how jenga-tower like the javascript ecosystem was. Eye opener!

Well npm doesn&#x27;t use GitHub for hosting of modules so honestly npm would be fine. Bower on the other hand would be completely screwed.

It is the nature of git that most repos on GitHub also exist in many other places.

That&#x27;s because central hubs are very useful...

The thing with DCVS is not that central hub does not exist. It is that you do not need specific central hub. That means if github dies, I can take any of my git repos I checked from github and continue working with them, and create a local git server that would allow others to work with it. Of course, there is a convenience value in having central hub. The point is not denying that, the point is turning it from necessity to option.

I still find it hilarious that, upon the bulk of SCM use shifting to a DVCS, the first[1] thing people did is run out to build a central hub.[1] For the pedantic, it probably was not literally the first thing; I&#x27;m sure some folks went to the rest room, others ate something, still others took a nap.

What would happen to all those NPM projects if GitHub is destroyed? I don&#x27;t think it will close anytime soon, but lets say, a meteor shower hits GitHub data center or something along the lines of this.

NPM and Left-Pad: Have We Forgotten How to Program?