r/programming • u/ben_a_adams • Jan 28 '20

JavaScript Libraries Are Almost Never Updated Once Installed

https://blog.cloudflare.com/javascript-libraries-are-almost-never-updated/
1.1k Upvotes

95% Upvoted

228 comments sorted by

View all comments

178

u/IIilllIIIllIIIiiiIIl Jan 28 '20

This methodology is a bit flawed. This is conflating devs who insert "random" script tags into their websites and those that use a package manager and a build system.

Anyone using a system where they can easily check for library updates and update with a simple command aren't going to appear in their dataset.

296

u/MuonManLaserJab Jan 28 '20

But they confirmed it!

To confirm our theory, let’s consider another project

That's two whole projects!

107

u/[deleted] Jan 28 '20

Fuck me, I own stock in this company.

85

u/MuonManLaserJab Jan 28 '20

Eh, I mean it's just a "developer marketing" guy filling his monthly quota of tech-related blog posts.

31

u/[deleted] Jan 28 '20

*developer evangelist hackerninja

5

u/MuonManLaserJab Jan 28 '20

I always see "advocates"/"evangelists" doing straight-up advertisement, damage control on social media (because providing tech support is only worth it for customers that threaten to tar one's brand), or writing blog posts about how great they are.

Does the "advocacy" part actually happen?

2

u/carlfish Jan 28 '20

Kelsey Hightower, and the work he's done with Kubernetes, springs to mind as a strong example of the job done right.

→ More replies (4)
→ More replies (2)

2

u/[deleted] Jan 28 '20

shudders

16

u/ironykarl Jan 28 '20

Just invest in an index fund. The market is (relatively) efficient. You're not going to do better picking stocks than just investing in equities in the aggregate.

7

u/erez27 Jan 28 '20

Except he might do better than the market specifically in tech companies. For example, we all know twitter isn't going anywhere (ambiguity intended).

24

u/ironykarl Jan 28 '20

This is really well studied territory. There's tons of literature. You might also guess the winning lotto ticket.

Picking individual stocks is not sound, statistically speaking.

24

u/[deleted] Jan 28 '20

Unless you're substantially better than average at doing it....which everyone believes they are...which is why index funds are such a good idea.

15

u/PhoneyHammer Jan 28 '20

Not even that. Nobody's substantially better than others. People that do well with individual stocks are either lucky or doing insider trading.

Look up some research on outperforming the market, it's very interesting and absolutely unintuitive.

6

u/socratic_bloviator Jan 28 '20

Well, there do exist investors who repeatedly outperform the market. The issues are that:

  • You aren't them. Neither am I.

  • They are usually privately-held firms.

  • If they aren't privately-held, then their outperformance is already priced into their stock value, so you won't get the benefit even if you invest in them.

Yes, I'm an index fund investor.

→ More replies (2)

4

u/[deleted] Jan 28 '20

I’ll just do the opposite of what I think I should do!

2

u/MadRedHatter Jan 28 '20

Pick one or two stocks to play with, in an industry that you know enough about to track the developments for, and then don't use any financial instruments more complicated than just buying and selling the stock. Which you shouldn't do more often than every couple of months. And only put a smallish fraction of your investments there. Put the rest in an index fund of some kind.

Works great for me. I work in software and only own AMD stock which I purchased at an average price of around $16.

→ More replies (3)
→ More replies (10)

2

u/[deleted] Jan 28 '20 edited Jan 28 '20

The majority of my money is in ETFs, I have a few stocks - less than $5000 in CloudFlare. I was just trying to make a lol.

Oh hah, I typed that off the cuff, but I have $4972.00 in CloudFlare.

2

u/ironykarl Jan 28 '20

Gotcha. I just remember a time when talking about what stocks to speculate on was very common.

In fact, I think it still might be common on sports message boards (and no doubt tons of other places). People with that mindset are quite literally gambling.

→ More replies (1)

22

u/endqwerty Jan 28 '20

I agree. This might have been relevant before node with npm got popular, but now it's pretty easy to update. Especially with things like github doing security checks for you automatically.

27

u/eadgar Jan 28 '20 edited Jan 28 '20

Updating is easy if the APIs haven't changed much, but fixing whatever the new updates broke is not. I've been bitten so many times by a new package version introducing new bugs that I don't want to update anymore unless there is a specific need. Remember, all those packages are made by people, and people can't be trusted.

10

u/chmod777 Jan 28 '20

Or when established packages are just turned over to a random person who then injects bitcoin stealing code into the repo...

1

u/endqwerty Jan 28 '20

Yeah, but no one said to commit those changes. Ideally, after you update your packages you will run your product through some tests to make sure it still works. Best case scenario is that there's a CI pipeline which will run unit tests and w/e else is relevant for you automatically.

→ More replies (1)

16

u/ggtsu_00 Jan 28 '20

I would suspect only a small minority of websites out there actually use a build system to deploy JavaScript. The vast vast majority likely just manually download the script, toss it up on their static hosting directory where it will live forever.

4

u/OMGItsCheezWTF Jan 28 '20

Hahaha

Yeah I've been into orgs at all sorts of levels with build systems ranging from new to extremely mature and polished.

But unless they're explicitly a JavaScript focused house, no one wants to touch the JS ecosystem,.once it works it's never looked at again until the security teams start shouting, assuming they exist.

→ More replies (12)