Well pip has the same problem as NPM : no namespaces by default. But NPM is wors... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		camus2 on Sept 18, 2017 \| parent \| context \| favorite \| on: Devs unknowingly use “malicious” modules snuck int... Well pip has the same problem as NPM : no namespaces by default. But NPM is worse with all its dependencies of dependencies. Composer (PHP) got both namespace and dependencies right: flat dependencies, it's up to the developer to resolve conflicts, not to the package manager to create insane dependency trees. It leads to more stable packages and make spotting fakes easier.

Can_Not on Sept 20, 2017 [–]

I'd say pip is definitely worse. Things like local dependencies, requirements.txt, and virtual env feel hacked add-ons to make pip more like npm

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact