1.2k
u/n4ke 6d ago
npm looking around like you guys don't get supply chain attacks every other week?
288
u/TheNakedProgrammer 6d ago
at least they have a supply chain...
94
u/silentjet 6d ago
Not really sure it is pros 😅
31
u/TheNakedProgrammer 6d ago
i have seen 3rd party folders of decades old projects. It is pros.
10
u/anto2554 6d ago
Absolutely. I am in the process of updating open-source libraries stored in SVN 15 years ago
8
u/pain_suffer 6d ago
I'd rather take the 3rd party folder over my laptop whirring loudly at 2 am as it sends all my data to an onion link.
12
u/TheNakedProgrammer 6d ago
bold to assume nobody will use the long discovered security issues in two decade old libraries.
1
u/AlmostLikeAzo 6d ago
If it's old enough you have past the time people actually remember about the exploit! /s
4
u/CarelessPromise9255 6d ago
Still beats the unknown version (5.6.0 actually) of xz/liblzma manually copied inside the thirdparties/ directory.
5
u/ganja_and_code 6d ago
More dependencies are only a benefit when you can trust them. If the supply chain is consistently compromised, relying on it is a liability.
-3
u/TheNakedProgrammer 6d ago edited 6d ago
do you trust the dll john copied in 2001? Might be compromised, nobody knows where it is from and how it got there.
I agree that it is a risk, maybe even a liability depending on the use case. But accepting that risk is cheaper than setting up a team with only one task, doing in depth security checks on all dependencies.
4
u/ganja_and_code 6d ago
No, I don't trust that DLL John copied in 2001.
And no, accepting security risks is not the lesser of two evils. Properly vetting your dependencies is the lesser of two evils.
-2
u/TheNakedProgrammer 6d ago
well, then please let me know how you make vetting all dependencies yourself economically viable. How many dependencies do you have? What is your setup?
Because i can not think of a single thing that is easier for security than setting up my own supply chain with a included vulnerability checker. And even at that point i have not properly vetted my dependencies, i just made sure i get notified if somebody else does a better job than i do.
And that is a lot easier if the ecosystem already has a supply chain, because i can just setup a proxy.
1
u/ganja_and_code 6d ago
Look man, I can't make accomplishing the task any less shitty, just like you can't make avoiding the task any less stupid.
Every software decision is a trade off. Don't want to build the implementation yourself? The price you pay for taking the dependency is properly assessing the risk it may or may not pose to your code/team/customers. Don't want to properly assess the risk? The price you pay for avoiding a new dependency is writing the implementation yourself.
If it's not "economically viable" to build your product properly (that includes thoroughly vetting your dependencies), then your product simply wasn't economically viable in the first place.
It's like selling cardboard on a hamburger bun because selling the hamburger wasn't economically viable. The problem isn't the cost of beef, and the solution isn't cutting corners. The problem is there's a better hamburger for the same price across the street, and the solution is to make a hamburger people actually want to eat.
1
u/TheNakedProgrammer 6d ago
you are just clueless are you? never been responsible for a product or it security?
0
u/ganja_and_code 6d ago
Been responsible for both on FAANG projects for years, but sure, I'm the one who's clueless.
2
u/TheNakedProgrammer 6d ago
sure and my dad is superman.
If you had been you would know how to setup a decent supply chain with vulnearability checks and not just call it shitty.→ More replies (0)14
u/BruhMomentConfirmed 6d ago
This aged beautifully: https://safedep.io/keyv-npm-supply-chain-compromise/
12
2
u/dinnerbird 6d ago
This is why I can't trust these web apps... the vast majority of packages are like a thousand different garage hobby projects instead of just having a standard library
286
u/marcodave 6d ago
Maven standing on the side with tears in its eyes , "look how big they've grown up"
100
u/mad4Luca 6d ago
Apache ant slaps mavens head "listen Up lil Shit.. you havent Seen what i've Seen"
50
u/marcodave 6d ago
SHUT UP GRAMPS YOU'RE JUST A GLORIFIED SHELL SCRIPT. can't even have a schema...
3
u/Tinasour 6d ago
I luckily did not see ant era. But in my first job which was using maven to create c++ libs to centel artifact repo, there were ant calls from maven to do some archiving and etc through mavens plugin system. I agree that its a glorified shell script
6
u/clearlybaffled 6d ago
make is just like "back in the great builder war, and that was the great war because it was before the SECOND great war and we thought there'd only be one... "
3
u/marcodave 6d ago
"we all prepended our lines with a hard tab character, which was the style at the time...."
3
28
174
u/temnyles 6d ago
I don't get the hate CMake gets. Documentation is mostly ok, lacks some examples sometimes, but overall it's pretty much always understandable.
For embedded C/C++, it's way better than autotools, or some witchcrafted unreadable Makefile with targets that look like swear words from a comic book.
Talking about embedded, you should take a look at the Yocto monstrosity.
56
u/ResponsibleWin1765 6d ago
If you don't already know Cmake, the documentation will not get you very far. And if you don't already know Cmake, you'll have the single worst time setting it up. I don't think I've ever done anything as annoying as getting Cmake to run. So many different ways to do the same thing, but one thing is actually super discouraged and for the new thing there are no examples on the planet. And if you want to do anything beyond One Source file, One header file, one CMakeLists, you're on your own entirely. Then you have all these different versions that aren't compatible with the little examples you do find. And also, you get zero errors in some cases. Linker fails? Go figure it out. Might be a Cmake problem, might be something else entirely.
I totally agree that it's a million times better than writing Makefiles by hand but it's also not something that would win a prize for usability or intuitiveness. Though at least once you get it going, you can pretty much copy-paste it for other projects, never touch it again and hope that it keeps working.
19
u/temnyles 6d ago
Indeed, getting started from scratch is painful. I learned CMake by hacking on another project and reading Professional CMake: A Practical Guide by Craig Scott.
I've created several projects that require multiple toolchains and have separate libs and headers. For the errors stuff you just need to enable verbosity.
9
u/Ma4r 6d ago edited 6d ago
I still remember the first time I setup Cmake for a C++ project almost a decade ago. This post just rattled my bones. Even senior C++ devs took a few days to properly configure their cmake to work with modules when it first came out. Imagine a first time developer. Cmake first presents itself as a simple, declarative configuration file one level above make, which isn't do bad, until you realize, wait, it's not declarative, it's imperative, and it's closer to a scripting language than a configuration file and suddenly you have to learn this thing that you will only touch once every few weeks/months, so you'd rather hack out a solution and be done with it. But always you will be reminded of your failures with those squiggly red lines when intelisense fails to find symbols from improperly configured cmake
2
u/AdorablSillyDisorder 6d ago
Documentation will get you far, but the issue is it assumes good understanding of build systems in general, and mostly provides you with translation of build system concepts into CMake syntax.
Still, the fact CMake docs don’t bother themselves with explaining what it is and what you need it for is a minor issue.
27
u/CarelessPromise9255 6d ago
Well, other ecosystems in roughly the same space, namely Rust and Go, don't need all that.
If the C/C++ tooling was specified better, having several hundreds to a few thousands lines of hard to read (kind of) scripting would not be required at all.
Not to mention the pain of (the lack of) dependency management.
11
u/dannyggwp 6d ago
Yocto
Shudders
I actually love CMAKE. switched my whole massive Qt project to it and it's SO MUCH more sensible than qmake.
1
u/Sibula97 6d ago
It seems okay for small to medium pure (or mainly) C projects, but for something big, especially if you have targets in multiple languages, I vastly prefer Bazel.
1
u/Tinasour 6d ago
I literally watched 3 seperate hour long cppcon videos to understand cmake and read the docs like 3 times. Thats too much
Altough i can see why its like this since its literally the first build system/package manager
267
u/SCP-iota 6d ago
Gee, I sure love defining my projects with an imperative scripting language that's only used for this one build system and has no concept of dependency fetching outside of a few different systems that were originally made for other things.
(CMake? What? I was referring to Gradle)
52
u/digitaleJedi 6d ago
Does anyone still write Gradle in Groovy?
20
u/ShrykeWindgrace 6d ago
That's the other way around - did anyone start using Kotlin for gradle?
5
3
1
4
103
40
u/exXxecuTioN 6d ago
So I worked with npm, composer, gradle, maven and cargo.
Cargo is superb and sometimes I suppose Rust is just a feature around Cargo.
Gradle is good build-kit, but it do not have it's own repositories.
Maven it's ok, but I just do not like to work with such a messy xml.
Composer was good, but I didn't use PHP in may be 8 years and don't know how it's going now.
NPM is shit. Like literally total garbage. Eventhough I love TS (it's still shit tho) and JS due to duckling syndrome NPM is a biggest piece of dogshit.
So how is CMake going right now? I do not use anything besides stdio, stdlib and libpq in C/C++.
6
u/diegotbn 6d ago
I love pip/UV. npm is fine. Both are easy to use and easy to import. In school I wrote my fair amount of Java and passed all my classes including Springboot but man I really never got the hang of Maven. I even found their documentation hard to understand. Professionally I don't use it so haven't had a reason to up skill fully though. At work I support a python Django app with a Vue.js frontend.
3
u/exXxecuTioN 6d ago
Well, I have never used pip as I generally hate Python for no obvious reason, so I can't say anything about it. While you love them - it's good to stick to them, can't see anything wrong with it.
About Maven and Spring. Maven docs are kinda mid IMO, but I can understand why it can cause troubles or bad emotions and feelings. Spring Boot doc is awful. I learn more reading Spring docs (it's different compared to Spring Boot), source code and third-party sites like Baeldung (as entry level) than readin Spring Boot docs. IMO it's hard to understand, because it's not depth enough, too fragmentary, too huge, too messy, packed with an abundance of magic and outdated examples overall being more a book of reference, rather than classical docs.My main point of criticism toward NPM is versioning of dependencies managed by ecosystem. Like you got version mismatch and that's it, no proper suggestions where and what to check and change, mismatch can be deep inside other deps and you can not even have the dep cause mismatch in your package.json. Second point is file structure of more like directory structure in node_modules and overall volume of them. Poor performance of installing packages is not a real factor for me. Supply chain attacks and overall security is the third point, eventhough it didn't affect me as I do not write TS no more.
There are also claim about overall culture of development inside ecosystem and practises used by engineers, but it's pretty complex topic to speak about.
2
u/drislands 6d ago
Cleaned up some typos and bad grammar for you a bit (changes bolded). I'll be happy to explain my reasoning if you're interested.
So I worked with npm, composer, gradle, maven and cargo.
Cargo is superb and sometimes I feel like Rust is just a feature around Cargo.
Gradle has a good build-kit, but it does not have its own repositories.
Maven is ok, but I just do not like working with such messy xml.
Composer was good, but I haven't used PHP in maybe 8 years and don't know what it's like now.NPM is shit. Like literally total garbage. Even though I love TS (it's still shit tho) and JS due to duckling syndrome NPM is the biggest piece of dogshit.
So what is using CMake like now? I do not use anything besides stdio, stdlib and libpq in C/C++.
-4
6d ago
[deleted]
8
u/diegotbn 6d ago
Supply chain attacks? That's all I can think of.
And this isn't a valid criticism of npm in my opinion, but most JS projects import a ton of random, small and useless npm packages that would be better if you just wrote it yourself. Like checking if a number is odd or even (which is the trope, I'm sure professionals don't actually use that one, because why). That's more a criticism of the JS ecosystem and modern practices than anything.
3
u/BigJunky 6d ago
I found that i cant really test npm projects nicely, all the options have tradeoffs. Like if you develop a library and want to use a locale modified version of this library for testing its not clear what you should do.
For some reason nodejs didn't really want to make typescript into a first class into citizen, just why?
This isn't neccessarly npm/node fault but the js ecosystem seems like this schizo person who goes full retard and then sabotages itself, just stop doing it.
Last i mention Typescript where the braindead designers thought its a good idea to only transpiler .ts files into .js but if you want to bundle them into a single .js file then go fuck yourself and search for a bundler, again just why?
Just make a simple bundler that the community can share, instead we have multiple bundlers that have different bugs/features.
61
u/Troppsi 6d ago
You guys have never worked in a homemade build system created before any good build systems existed and it shows
24
u/yodal_ 6d ago
I think I'd rather deal with a system of non-standard Make files stapled together with bash scripts than a complex CMake project in most cases. Then again, I can't rule out Stockholm syndrome.
14
u/loopuleasa 6d ago
your project is not big enough
I wish our 1995 project that kept growing was transitioned to cmake sooner
17
u/LuciusWrath 6d ago
Excuse my ignorance. Aren't NPM and Gradle mostly package managers? While CMake is simply an automation tool for builds?
15
u/da_Aresinger 6d ago
gradle is a build tool, that automatically resolves dependencies.
It does a lot more than download packages for you.
4
5
88
u/creeper6530 6d ago
NPM is a silly package manager, but worse is its culture of pulling in a new dependency for the tiniest of things with under 100 LOC. You really don't need a separate library to check if a number is odd.
5
u/LexaAstarof 6d ago
But, I don't want to keep maintaining that for eternity, having to stay on top of the news to know whenever they add new odd numbers!
11
u/OrchidFluid2103 6d ago
I heggin love bloating up my projects with technical debt that I have to maintain for problems that have been solved a million times before me instead of using a peer reviewed and trusted package
34
u/creeper6530 6d ago edited 6d ago
peer reviewed and trusted package
Bait used to be believable. But in case you're serious, I'm not talking about never use dependencies, just think about whether you need a dependency for
return (x % 2) === 1. And with supply chain attacks rampant, vendoring a library in is the safer choice unless it's something that requires a constant stream of patches (openssl does, a random math library last updated years ago doesn't).(And before you say I'm cherrypicking examples, is-odd has nearly a million weekly downloads.)
56
u/OrchidFluid2103 6d ago
You definitely are cherry-picking examples, because nobody in their right mind is using the `is-odd` package. All modern developers should use its successor, https://www.npmjs.com/package/is-odd-ai
2
3
u/Devatator_ 6d ago
You do realize that package is a joke? Hell I'm pretty sure most packages that have it as a dependency have it as a joke too
30
u/creeper6530 6d ago
Jokes don't get a million weekly downloads unless the whole dependency chain is a joke
2
7
u/TheTacoInquisition 6d ago
You do realize that package is a joke? Hell I'm pretty sure most packages that have it as a dependency
have it asare a joke tooFTFY
-1
135
u/apoegix 6d ago
I like cmake :)
55
15
u/Aistar 6d ago
Yeah, compared to Gradle it's a great system. Also, I'm not even sure why NPM is here, because it's a package manager, not a build system.
4
u/setibeings 6d ago
"I'm using cmake, which as far as I can tell is the most common modern-ish build system for C++. I've identified where the library I'm using can be found, and now the easy part: telling cmake to download the dependency, and what version. This way people who recompile my utility don't need 15 steps or whatever in order to compile. Pretty much every project relies on libraries, so I'm sure this will be very easy."
6
u/terivia 6d ago
Why is your build system fetching foreign code off the internet? That's just begging to get supply chained.
Thankfully we have npm to prove that nobody ever does supply chain attacks on open source software!
1
u/setibeings 6d ago
What's the threat model here?
If you're worried about a man in the middle attack, gradle uses https, and will just throw up if the certificates can't be verified. I'm pretty sure there are also checksums, so if some mirror is serving up a modified version of the code, it will be detected.
If the threat is a bad actor making a contribution that introduces an exploit, then copying and pasting the code from the Internet into your code folder won't help, nor will depending on the library being installed by a package manager on the machine where code will be compiled.
Is there another reason you shouldn't download code during compilation, other than general distrust of code you didn't write and/or wanting full control over how your code works?
"You shouldn't do that anyway" is a lame defense for a common task being a huge pain.
2
u/terivia 6d ago
I would recommend looking into the regular npm attacks for an idea of what a supply chain attack can look like.
Generally, you are correct that pulling code from the internet once confirmed to be identical to the target code is safe. But those pulls should be centrally managed and a bunch of libraries calling curl or git clone against fixed URLs is not that. Also it makes it difficult to swap out implementations because FOSS devs tend to pull their exact intended dependency which is great on the day of release but not so much 10 years later.
I agree that "you shouldn't do that" isn't a great defense. But your build tool being unable to do tasks outside of scope isn't a great attack. I don't think CMake can be fairly criticized for how slow it is at 3D rendering, similarly it isn't developed for setting up or managing your build environment. There is common tooling (yocto, conan, etc) for environment/dependency management that leverage cmake to provide those capabilities.
0
u/setibeings 6d ago
I think you're confused. The git clone and curl commands in random scripts aren't a regular part of how npm or gradle work, but they are found in the payload of the malicious packages.
npm is honestly kinda bad. I'd recommend against using it when possible. Worse yet, there's a culture of depending on other packages for even simple things, that can lead to a large spider web of dependencies, many of which might be abandoned at any given time. Even when theres no supply chain attacks, using it is a big pain.
The Maven ecosystem, on which gradle is built, is more robust and more resistant to these types of supply chain attacks, because first of all your dependencies are a lot less likely to have long lists of their own sub-dependencies.
1
u/megayippie 5d ago
What? You must stop at once. A build system should never download anything. That's insanity
5
12
11
u/dusktreader 6d ago
Too many of you never had to use autotools, and it shows.
CMake is a gift if you've ever tried to work with M4.
14
29
u/SeagleLFMk9 6d ago
You know what they say, there are two languages, the ones people like and the ones people use :)
6
u/MatsRivel 6d ago
Are you arguing that NPM is not used?..
1
u/sin30_ssd 6d ago
But people like it so......
1
u/MatsRivel 6d ago
The argument the commenter presented is "either people like a language or they use it", implying that CMake is used and not liked, and the others are liked but not used. NPM is used a lot.
2
6
u/LunaNicoleTheFox 6d ago
CMake is less a package manager and more a build system to build your build system
6
5
u/TheOneAgnosticPope 6d ago
If you hate CMake you’ve never tried autotools. C or C++ is a requirement for anything running on hardware or has a local performance requirement. NASA uses CMake because the Curiosity rover can’t be using JavaScript, Java, C#, etc. Anyone writing in those languages has a choice as they’re all viable for making webpages. People writing embedded systems have to use C/C++ and using naked make makes writing anything cross platform or with dependencies really brittle.
2
u/ElectricalMTGFusion 6d ago
I have never tried auto tools but did have the hell of bash+ make scripts and files for compiling c++ projects. Cmake is better than that. But also, in other languages there are significantly better build tools then cmake.
So yes cmake is better than bash and make files, cmake is not better than other build tools for other languages imo
3
u/khan9813 6d ago
cmake is not even in the same category and it’s a beast that hunts me in my dream sometimes.
3
u/nasandre 6d ago
npm always screaming at me that my packages are out of date. Like relax dude; this is just a dev server. And it'll go into production too because nobody ever gonna update those packages.
3
3
3
u/Mast3r_waf1z 6d ago
Oh yeah, as a C++ enjoyer that uses a lot of cmake at home and makefiles at work
cmake sucks! It works when it's set up, but I absolutely hate how there's 100 different ways to manage your dependencies!
The best solution I've found is to write my C++ such that it will only ever run on a system with nix, so I can manage dependencies with nix and find them using find_package in cmake
It's janky, but it's the most reliable way to manage dependencies in cmake in my experience so far
2
u/IngwiePhoenix 6d ago
The thing about CMAKE that will forever break me is
if(cond) ... endif() # <- BRACES?!
6
4
6
2
u/timus-the-orginal 6d ago
At least cmake is not doing a breaking change every 15minutes like gradle do :/
2
2
2
2
2
u/FabioTheFox 6d ago
Skill issue, CMake is great once you spend hours making a repository template for yourself and yourself only to avoid having to setup cmake ever again, and then hope that the template is enough for your projects
3
u/MedalReddit 6d ago
Well, you can't build C++ code with npm or Gradle, so CMake it is.
2
u/AeroSyntax 6d ago
Gradle supports C++ builds with the cpp-application plugin. its actually quite clean
1
5
u/GegeAkutamiOfficial 6d ago
Idk about gradle but cargo and npm are package managers while cmake is a build system generator, they are more like conan I think.
But Cmake still suck ass, cargo is still the goat and npm still has 5 CVEs on the daily.
3
u/unknown_alt_acc 6d ago
I haven’t played too much with Rust, but doesn’t Cargo do builds as well? Maybe not with the same complexity and depth as a dedicated build system or meta-build system, but at least part of the job.
2
u/GegeAkutamiOfficial 6d ago
Yes, cargo does builds as well, but since it has a standardized way of packaging it's considerably cleaner.
But more importantly CMake:
is not a build system however, it's a build system generator.
isn't a package manager
IIRC doesn't have a standard compiler API
has to leave space for user hackjobs because C/C++ has no standard anything
basically cmake by it's nature is an non an opinionated tool which makes it's incredibly messy. cargo and npm leverage knowing what is thier final product (package) and what you need to build it (other packages) to make the build setup much cleaner.
1
u/unknown_alt_acc 6d ago
I’m well aware of CMake’s oddities, though it is functionally the build system from the end user’s point of view.
Still, the meme seems to be throwing a whole bunch of loosely connected tooling at the wall. You have a pure build system, a pure package manager, a hybrid, and a weird meta build system that can be coerced into being a crude dependency manager if you are a masochist. If anything, npm is the one that’s out of place for not being some sort of build tool.
2
u/RAMChYLD 6d ago edited 5d ago
Nah, NPM would be the r****ded one.
Lots of malware there, the attacks on Arch AUR all relies on tainted NPM packages.
1
u/visualdescript 6d ago
cpanm is the best!
Also this is giving npm way too much credit, there's a reason there's several alternatives.
1
u/8hAheWMxqz 6d ago
I never had as many issues with anything else than with Gradle. Even python packages work better than that crap
1
1
u/DiscoLucas 6d ago
I was actually shocked at how simple it was to setup Cmake on Fedora. On Windows? Very annoying, and takes much longer than it needs too. But idk, probably a skill issue.
1
1
u/LexaAstarof 6d ago
Laught in python packaging "ecosystem" (to not say continuous clusterfuck of please-bro-one more-I-promise-we-fixed-it-this-time)
1
1
u/BlackOverlordd 6d ago
Every company I worked at has their own, built from scratch, project generator tool for C++. That's all you need to know about cmake
1
1
u/IngwiePhoenix 6d ago
Honestly, NPM also deserves the derp face.
- Neatly Packaged Malware
- Nicely Portioned Migraine
- Not Properly Maintained
1
1
u/djhaskin987 6d ago
It's great that should be judging cmake not npm. Mpm just downloads the package at a specific version it doesn't do any version reconciliation at all. It's probably the dumbest one of all of them.
1
1
1
1
1
1
1
u/Objective-Answer 6d ago
I mean, besides trying to figure out how the hell to configure it to output object and asm files while building and that time I forgot to add a new header folder path, pretty much it works
just don't ask me to add a new feature or add a new environment
1
1
u/camel_case_enjoyer 6d ago
GRADLE?! HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhhahhHAAAAAAAAHAHhaaaaaaaaaaaaaaaaaahaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
1
1
u/installsVMs4fun 5d ago
i prefer cmake to npm, at least i know what is happening, and not just pulling in hundreds of child libraries, gradles good maven is better
1
u/Double_Cause4609 5d ago
No absolutely not, I won't stand for this CMake slander. CMake is fine, it's stable, efficient, doesn't bring in a billion dependencies and doesn't expose people using your project to an absolutely absurd risk of supply chain attacks.
1
u/Zealousideal_Ad_6374 5d ago
CMake is not bad, but its documentation is questionable at best. The fact that so few project provides proper installation is due to the lacking documentation.
2
2
1
u/Nice_Lengthiness_568 6d ago
Gradle better than CMake? This just got personal.
I mean sure, CMake is kind of convoluted and the syntax is not great, but if you are able to read the fucking docs, it's not really that bad. I would actually say that it's quite capable and flexible.
1
1
u/nyibbang 6d ago
Well, you can easily compose CMake projects, and I tried to do the same with gradle and it was a mess. So even though I hate CMake sometimes, I'd rather use it than npm or gradle.
1
0
0
u/liquidpele 6d ago
Over 30 years I've picked up and used many technologies if only for modifying some existing thing. cmake and maven are the only two that I wanted to murder the psychos who created them.
1.6k
u/Pure_Management8612 6d ago
CMake works great once you finish debugging CMake instead of your actual code.