upvote

points

by betaby23 hours ago |
comments
upvoteby cobbal22 hours ago|
next
[-]
They're not doing so here, but shipping a wasm-compiled binary with npm that uses node's WASI API is a really easy way to ship a cross-platform CLI utility. Just needs ~20 lines of JS wrapping it to set up the args and file system.
reply
upvoteby mountainriver22 hours ago|
parent|
next
[-]
Doesn’t this seem excessive over just using rust’s cross platform builds?
reply
upvoteby csomar21 hours ago|
parent|
[-]
There's no such thing as a truly "cross-platform" build. Depending on what you use, you might have to target specific combinations of OS and processor architecture. That's actually why WASM (though they went with WASI) is a better choice; especially for libraries, since anyone can drop it into their environment without worrying about compatibility.
reply
upvoteby jitl20 hours ago|
parent|
[-]
there’s 3 os and 2 architectures minus darwin-amd64 so you just need to do 5 builds to avoid the WASM performance tax.

(freebsd runs linux binaries and the openbsd people probably want to build from source anyways)

reply
upvoteby Lord_Zero22 hours ago|
parent|
prev|
[-]
Can you link to a sample of how I can do this?
reply
upvoteby varenc22 hours ago|
prev|
next
[-]
I found that strange as well. My guess is that `npm` is just the package manager people are most likely to already have installed and doing it this way makes it easy. They might think asking people to install Cargo is too much effort. Wonder if the pattern of using npm to install non-node tools will keep gaining traction.
reply
upvoteby m00014 hours ago|
parent|
next
[-]
It's still weird. Why not just use an effing install.sh script like everybody else? And don't tell me "security". Because after installation you will be running an unknown binary anyway.
reply
upvoteby bigstrat200321 hours ago|
parent|
prev|
next
[-]
Most people aren't going to have npm installed though. Nobody outside of web devs uses it.
reply
upvoteby patates17 hours ago|
parent|
next
[-]
A lot of people who are not web devs use it, that's what I see. I even saw some mainframe developers use npx to call some tool on some data dump.

Also, this is a web project anyway. Google Workspace is web based, so while there is a good chance that the users aren't web developers, it's a better chance that they have npm than anything else.

In the case that they don't, releases can be downloaded directly too: https://github.com/googleworkspace/cli/releases

reply
upvoteby gempir17 hours ago|
parent|
prev|
next
[-]
If you had to pick one package manager that was most likely installed across all the different user machines in the world, I'd say npm is a pretty good bet.
reply
upvoteby sankalpmukim20 hours ago|
parent|
prev|
[-]
"Most people" are webdevs

Bracing for getting cancelled

reply
upvoteby freakynit22 hours ago|
parent|
prev|
[-]
Why not just downloadable binary then?
reply
upvoteby varenc22 hours ago|
parent|
next
[-]
For many, installing something with npm is still easier. It chooses the right binary for your OS/architecture, puts it on your PATH, and streamlines upgrades.

Their Github releases provides the binaries, as well as a `curl ... | sh` install method and a guide to use github releases attestation which I liked.

reply
upvoteby krzyk11 hours ago|
parent|
next
[-]
I feel better with `curl ... | sh` than with npm.

npm suggests projects written in js, which is not something I'm comfortable.

It is nice to see that this is not JS, but Rust.

reply
upvoteby varenc3 hours ago|
parent|
[-]
Agreed! The `curl ... | sh` is sketchy, but it's more obviously a security risk and easier to inspect. With install hooks, `npm install ...` also allows arbitrary code execution when you run it, but this is less obvious.
reply
upvoteby freakynit21 hours ago|
parent|
prev|
[-]
Hmm, that's right... thanks..
reply
upvoteby brunoborges22 hours ago|
prev|
next
[-]
NPM as a cross platform package distribution system works really well.

The install script checks the OS and Arch, and pulls the right Rust binary.

Then, they get upgrade mechanism out of the box too, and an uninstall mechanism.

NPM has become the de facto standard for installing any software these days, because it is present on every OS.

reply
upvoteby danpalmer22 hours ago|
parent|
next
[-]
To my knowledge NPM isn't shipped in _any_ major OSes. It's available to install on all, just like most package managers, but I'm not sure it's in the default distributions of macOS, Windows, or the major Linux distros?
reply
upvoteby anilgulecha22 hours ago|
parent|
[-]
No package manager is. But of the ones that are installed by users, npm is probably the most popular.
reply
upvoteby spinagon22 hours ago|
parent|
next
[-]
What about pip? It's either installed or immediately available on many OSes
reply
upvoteby Fabricio2020 hours ago|
parent|
next
[-]
pip might be but it was historically super inconsistent (at least in my experience). Is it `pip install`? `python3 -m pip install`? maybe `pip3 install`? Yeah ubuntu did a lot of damage to pip here. npm always worked because you had to install it and it didnt have a transition phase from python2 being in the OS by default.
reply
upvoteby piperswe22 hours ago|
parent|
prev|
next
[-]
`pip install` either doesn’t work out of the box or has the chance to clobber system files though
reply
upvoteby jitl21 hours ago|
parent|
prev|
next
[-]
system pip w/ sudo usually unleashes Zalgo, i’d rather curl | bash but npm is fine too. it’s just about meeting people where they’re at, and in the ai age many devs have npm

if you build for the web, no matter what your backend is (python, go, rust, java, c#), your frontend will almost certainly have some js, so likely you need npm.

reply
upvoteby nikanj21 hours ago|
parent|
prev|
[-]
This is about eight years old. The python situation has mostly gotten worse since https://xkcd.com/1987/
reply
upvoteby jitl20 hours ago|
parent|
next
[-]
python packaging / envs is solved now by uv. its not promising or used by people in the know like the last 2 trendy python package managers. i was a big time python hater since it was a pita to support as a devtools guy but now its trivial. uv just works, it won.
reply
upvoteby abustamam11 hours ago|
parent|
[-]
I'm not a python dev, but I see a bit of its ecosystem. How does uv compare with conda or venv? I thought JS had the monopoly on competing package managers.
reply
upvoteby a_t4820 hours ago|
parent|
prev|
[-]
What? It’s much much better now, you can just use uv. Yeah, it’s yet another package manager, but it does it well.
reply
upvoteby chrisweekly9 hours ago|
parent|
[-]
Or go up a rung or two on the abstraction ladder, and use mise to manage all the things (node, npm, python, etc).
reply
upvoteby 21 hours ago|
parent|
prev|
next
[-]
deleted
reply
upvoteby 22 hours ago|
parent|
prev|
[-]
deleted
reply
upvoteby oefrha22 hours ago|
parent|
prev|
next
[-]
> The install script checks the OS and Arch, and pulls the right Rust binary.

That's the arbitrary code execution at install time aspect of npm that developers should be extra wary of in this day and age. Saner node package managers like pnpm ignore the build script and you have to explicitly approve it on a case-by-case basis.

That said, you can execute code with build.rs with cargo too. Cargo is just not a build artifact distribution mechanism.

reply
upvoteby mcmcmc19 hours ago|
parent|
prev|
next
[-]
More of a de facto standard for supply chain attacks tbh
reply
upvoteby mountainriver22 hours ago|
parent|
prev|
next
[-]
Yeah except you need to install NPM, whereas with a rust binary, which can easily compile cross platform, you don’t.

Honestly I’m shocked to see so many people supporting this

reply
upvoteby bigstrat200321 hours ago|
parent|
prev|
next
[-]
> NPM has become the de facto standard for installing any software these days, because it is present on every OS.

That's not remotely true. If there is a standard (which I wouldn't say there is), it's either docker or curl|bash. Nobody is out there using npm to install packages except web devs, this is absolutely ridiculous on Google's part.

reply
upvoteby abustamam11 hours ago|
parent|
next
[-]
I agree but this isn't a Google project, it's one Google employee.
reply
upvoteby jitl20 hours ago|
parent|
prev|
[-]
they offer npm for the large market of cli users who have it, and curl|bash to those who don’t. ¯\_(ツ)_/¯
reply
upvoteby xarope20 hours ago|
parent|
prev|
next
[-]
"NPM has become the de facto standard for installing any software these days, because it is present on every OS."

What?!? Must not be in any OS I've ever installed.

Now tar, on the other hand, exists even in windows.

reply
upvoteby koakuma-chan20 hours ago|
parent|
prev|
[-]
I think there has been an influx of people vibe coding in Rust because its "fast" but otherwise they have no idea about Rust.
reply
upvoteby gck118 hours ago|
parent|
[-]
Not because it's fast, but because of its compiler. It acts as a very good guardrail and feedback mechanism for LLMs.
reply
upvoteby abustamam11 hours ago|
parent|
[-]
Typescript has surpassed Python and JS as most used on Github for a similar reason

https://xcancel.com/github/status/2029277638934839605?s=20

reply
upvoteby koakuma-chan9 hours ago|
parent|
[-]
> making strict typing an advantage, not a chore

It's crazy that people think strict typing is a chore. Says a lot about our society.

reply
upvoteby abustamam7 hours ago|
parent|
[-]
I learned TS after a few years with JS. I thought having strict types was cool. Many of my colleagues with much more (JS) experience than me thought it was a hassle. Not sure if they meant the setup or TS or what but I always thought it was weird.
reply
upvoteby r2champloo21 hours ago|
prev|
next
[-]
Interesting fact, because cargo builds every tool it downloads from source, you can’t actually run cargo install on Google laptops internally.
reply
upvoteby efreak16 hours ago|
parent|
[-]
I use cargo-binstall, which supports quick install and a couple other methodsfor downloading binaries for rust packages
reply
upvoteby jamesmishra22 hours ago|
prev|
[-]
Why should the package's original language matter?

When I use apt-get, I have no idea what languages the packages were written in.

reply
upvoteby hahn-kev19 hours ago|
parent|
next
[-]
Because npm is not an os package manager, it's a nodejs package manager
reply
upvoteby dgellow2 hours ago|
parent|
[-]
It’s actually not node specific
reply
upvoteby nazgul1719 hours ago|
parent|
prev|
[-]
Not everyone has or wants yet another package manager in their system.
reply