Top
Best
New

Posted by birdculture 1 day ago

Package managers keep using Git as a database, it never works out(nesbitt.io)
707 points | 394 commentspage 3
nottorp 11 hours ago|
> Auto-updates now run every 24 hours instead of every 5 minutes

What the... why would you run an autoupdate every 5 minutes?

gethly 1 day ago||
If we stopped using VCS to fetch source files, we would lose the ability to get the exact commit(understand as version that has nothing to do with the underlying VCS) of these files. Git, Mercurial, SVN.., github, bitbucket...it does not matter. Absolutely nobody will be building downloadable versions of their source files, hosted on who knows how "prestigious" domains, by copying them to another location just to serve the --->exact same content<--- that github and alike already provide.

This entire blog is just a waste of time for anyone reading it.

throwway120385 1 day ago||
Or you could just ship a tarball and an sha checksum.
gethly 1 day ago||
you could, in case you want to make only certain releases publicly available. but then, who wants to do that manual labour? we're talking mainstream here, not specific use cases.
layer8 1 day ago|||
And yet, that's pretty much how the Java world works (Maven repositories).
forrestthewoods 1 day ago||
> This entire blog is just a waste of time for anyone reading it.

Well that’s an extremely rude thing to say.

Personally I thought it was really interesting to read about a bunch of different projects all running into the same wall with Git.

I also didn’t realize that Git had issues with sparse checkouts. Or maybe author meant shallow? I forget.

the__alchemist 1 day ago||
The Cargo example at the top is striking. Whenever I publish a crate, and it blocks me until I write `--allow-dirty`, I am reminded that there is a conflation between Cargo/crates.io and Git that should not exist. I will write `--allow-dirty` because I think these are two separate functionalities that should not be coupled. Crates.io should not know about or care about my project's Git usage or lack thereof.
cesarb 12 hours ago|
> The Cargo example at the top is striking. Whenever I publish a crate, and it blocks me until I write `--allow-dirty`, I am reminded that there is a conflation between Cargo/crates.io and Git that should not exist. I will write `--allow-dirty` because I think these are two separate functionalities that should not be coupled.

That's completely unrelated.

The --allow-dirty flag is to bypass a local safety check which prevents you from accidentally publishing a crate with changes which haven't been committed to your local git repository. It has no relation at all to the use of git for the index of packages.

> Crates.io should not know about or care about my project's Git usage or lack thereof.

There are good reasons to know or care. The first one, is to provide a link from the crates.io page to your canonical version control repository. The second one, is to add a file containing the original commit identifier (commit hash in case of git) which was used to generate the package, to simplify auditing that the contents of the package match what's on the version control repository (to help defend against supply chain attacks). Both are optional.

the__alchemist 9 hours ago||
Those are great points, and reinforce the concept that there is conflation between Cargo and Git/commits. Commits and Cargo IMO should be separate concepts. Cargo should not be checking my Git history prior to publishing.
mikkupikku 1 day ago||
People who put off learning SQL for later end up using anything other than a database as their database.
redog 1 day ago||
SQL killed the set theory star
groundzeros2015 1 day ago||
Is sql over ssh a thing?
yawaramin 17 hours ago||
https://litestream.io/
groundzeros2015 5 hours ago||
A proprietary cloud subscription doesn’t seem like the right fit for this
yawaramin 3 hours ago||
As opposed to a proprietary cloud git hosting platform?
bencornia 1 day ago||
> Grab’s engineering team went from 18 minutes for go get to 12 seconds after deploying a module proxy. That’s not a typo. Eighteen minutes down to twelve seconds.

> The problem was that go get needed to fetch each dependency’s source code just to read its go.mod file and resolve transitive dependencies. Cloning entire repositories to get a single file.

I have also had inconsistent performance with go get. Never enough to look closely at it. I wonder if I was running into the same issue?

zahlman 1 day ago||
> needed to fetch each dependency’s source code just to read its go.mod file and resolve transitive dependencies.

Python used to have this problem as well (technically still does, but a large majority of things are available as a wheel and PyPI generally publishes a separate .metadata file for those wheels), but at least it was only a question of downloading and unpacking an archive file, not cloning an entire repo. Sheesh.

Why would Go need to do that, though? Isn't the go.mod file in a specific place relative to the package root in the repo?

klooney 1 day ago||
Go's lock files arrived at around the same time as the proxy, before then you didn't have transitive dependencies pre baked.
fireflash38 1 day ago||
How long ago were you having issues? That was changed in go 1.13.
bandrami 1 day ago||
Maybe I'm misreading the article but isn't every example about the downside of using github as a database host, not the downside of using git as a database?

Like, yes, you should host your own database. This doesn't seem like an argument against that database being git.

zzo38computer 1 day ago||
Git commits will have a hash and each file will have a hash, which means that locking is unnecessary for read access. (This is also true of fossil, although fossil does have locking since it uses SQLite.)

The other stuff mentioned in the article seems to be valid criticisms.

ekjhgkejhgk 1 day ago||
Uncertain if this is OT, but given that the CCC is politically inspired organization, I hope not:

One thing that still seems absent is awareness of the complete takeover of "gadgets" in schools. Schools these days, as early as primary school, shove screens in front of children. They're expected to look at them, and "use" them for various activities, including practicing handwriting. I wish I was joking [1].

I see two problems with this.

First is that these devices are engineered to be addictive by way of constant notifications/distractions, and learning is something that requires long sustained focus. There's a lot of data showing that under certain common circumstances, you do worse learning from a screen than from paper.

Second is implicitly it trains children to expect that anything has to be done through a screen connected to a closed point-and-click platform. (Uninformed) people will say "people who work with computers make money, so I want my child to have an ipad". But interacting with a closed platform like an ipad is removing the possibilities and putting the interaction "on rails". You don't learn to think, explore and learn from mistakes, instead you learn to use the app that's put in front of you. This in turn reinforces the "computer says no" [2] approach to understanding the world.

I think this is a matter of civil rights and freedom, but sadly I don't often see "civil rights" organizations talk about this. I think I heard Stallman say something along these lines once, but other than that I don't see campaigns anywhere.

[1] https://www.letterjoin.co.uk/

[2] https://youtu.be/eE9vO-DTNZc

AceJohnny2 1 day ago|
It looks like you commented on the wrong post, although I don't immediately see a front-page post about the ongoing Chaos Computer Congress.
kzrdude 1 day ago|||
it's here https://news.ycombinator.com/item?id=46386211 (and it was last on the front page at the moment)
ekjhgkejhgk 1 day ago||
ty
ekjhgkejhgk 1 day ago|||
LOL sorry. You're right. I'll copy paste over there.
teiferer 1 day ago||
And this my friends is the reason why (only) focusing on CPU cycles and memory hierarchies is insufficient when thinking of the performance of a system. Yes they are important. But no level of low-level optimization will get you out of the hole that a wrong choice of algorithm and/or data structure may have dug you into.
More comments...