Support Platform IO

[danielmeza]

This libraries are amazing, we should make it available to Platform IO
Here is a guide https://docs.platformio.org/en/latest/librarymanager/creating.html?utm_source=platformio&utm_medium=piohome

[trombik]

personally, i do not see the point of its library repository. pio lib search is a big joke. you can use any library with a git URL in platformio.ini.

[danielmeza]

That's true, but user that just start will benefit from this.

[trombik]

please explain the benefits.

[danielmeza]

The users that just start with the Platform IO could find with ease all the libraries implemented here from the lib search and not only using the git URL on the platformio.ini file.

I need to say that I'm one of those users that just start with the platform.

[trombik]

as i stopped using pio as a build platform for esp-idf since a few years ago, i might be wrong. however, here is the issues:

1. the pio library repository does not require you to be the owner of the library. anyone can submit a library as a candidate. there was no way to verify the origin (is this still true? i don't know).
2. pio does accept libraries with an identical name (this might have been solved by owner attribute in .pio, though)
3. as a result, you are not sure the library you are about to install is what you really need. someone forks this repository and register it under his/her name. how do you know which one you should use? you have to remember the name of the owner. then, the saving is just "https://github.com/".

even if all the above issues are solved somehow, you have to trust pio. I don't because of other issues in the past not mentioned here.

i know pio is trying to be user-friendly, like arduino. if typing "https://github.com/UncleRus/esp-idf-lib" is too hard, i would say i'm sorry. you will need more than that in platformio.ini sooner or later (does pio support sdkconfig or idf.py menuconfig now? i don't know).

if someone wants to implement and maintain it, please go ahead. i am not against that.

[trombik]

I think this thread is an appropriate place to describe my thoughts about platform IO and arduino, more specifically, dependency.

it looks to me that more and more programmers rely on libraries. the idea of reusable library is great. but the current trend worries me. people take it grated for being able to install and use libraries by a command, a line of code, or a click. convenient, isn't it.

recently, I was playing with a software, written in JavaScript. you can install it by a single command, npm install. the install process told me it was installing more than 1,000 packages. some direct dependencies were pinned to specific versions. naturally, npm audit told me it had found several critical vulnerabilities. some dependencies had a few line of code, just a single function. i was thinking, do you really need them? maybe, JavaScript is an extreme example, but the trend is the same in some other languages.

have you ever looked at the library code you are relying on? i like esp-idf-lib because it is simple, well-documented, and written with discipline. people say that "arduino has a lot of libraries!". how many of them handle errors properly? arduino is not C++, nor it has exception. arduino users just look for a library they think they need without looking at code.

the Internet, or networking, enables us to do many things. you don't have to download everything by hand. pio run, npm install, or even wget -O - | sudo sh do that for you. the question is, are you sure that it is what you think? what if it is not? a few years ago, one FreeBSD user asked platform IO devs to support FreeBSD. they told that they were happy to support it, but needed contributions from users. another users reported that he was able to compile the esp-idf toolchain. one dev asked him to upload compiled binaries to somewhere so that they could distribute the toolchain. and, surprisingly, they did. they distributed unknown binaries from unknown sources. since then, I never trust them. this happened elsewhere, too. I never trust central repositories that do not verify what they distribute. this is a real risk, and incidents actually happened many times in the past.

while libraries and easy install process save us time, you have to evaluate the trade-offs, which is what engineering is. arduino might have made the hurdle lower to learn programming, but it seems to me that it sweeps too many dusts under the rug. they are teaching how to use libraries.

dependencies should be limited as much as possible. you should evaluate the trade-offs. you should verify origins of dependencies. that's what I think about dependencies.

[danielmeza]

I agree with you, but this is something that mus be done not matter if the library is downloaded manually or using a command like npm install, bad developer take bad decisions. On the other hand, have tools that make you easy to work is something that should be done event if bad developers exist, otherwise tooling would never get improved.

[trombik]

I wrote the post so that I can point at the post how I like Arduino and pio, and how I think about dependency. if you think your idea is great, raise your hand and step up. propose your idea and a possible implementation. move your hands, and hack. add tests to the CI. write documentation. don't forget expectation management. when you add a new feature, users expect that it works and it will. make it easier to maintain it even after you left the project.

I'm not against that and it would be more productive.