The author of dotenv has no plans to stop including advertisements within the package. Should wxt reconsider its implementation approach for environment variables?

[lvzhenbo]

The author of dotenv has closed the relevant issue discussion and stated that they will not change the policy of mandating the use of dotenvx.
motdotla/dotenv#922 (comment)

[aklinker1]

🤷 as an open source maintainer, I can see why the dev would add this. For packages that become as fundamental as dotenv plus AI, I don't blame them.

I believe we did automatically silence this log though, someone opened a PR.

[lvzhenbo]

Now let's talk about AI. AI has indeed had a significant impact on the open-source community—for better or worse—and that's the trend. It's also an opportunity, as AI has drastically lowered the barrier to entry for software development. This is where inspiration becomes crucial. When inspiration and market demand collide to spark innovation, can you really call AI a bad thing? Some complain, while others embrace the new. That's just how progress unfolds.

[aklinker1]

I don't disagree about that. But that means the old way of promos, in this case for dotenvx, doesn't work. If no one visits your repo/npm page/doc site where these promos have been for 10 years, how would you promote your other products?

[lvzhenbo]

This issue falls outside my area of expertise, as I lack experience in marketing. Therefore, I cannot provide a definitive conclusion. However, based on my current observations, AI has begun replacing search engines as a primary gateway for information retrieval. While its core function remains performing searches on behalf of users, the challenge lies in how to effectively summarize and present these results to people—this is a technical problem. If you've followed the development of AI in China, you'll notice some companies are starting to tie their products to their own AI output. Another intriguing phenomenon is the deliberate contamination of AI with vast amounts of artificially generated content—though whether this aligns with ethical or legal standards remains debatable. In short, traditional search engine and SEO tactics may still hold some value, but under AI technology, identifying marketing approaches that operate within AI's rules is the fundamental solution. At the very least, bombarding users' devices with frequent advertisements is not a wise strategy. If everyone adopts this approach, how does it differ from a virus or malware?

[aklinker1]

If everyone adopts this approach, how does it differ from a virus or malware?

You really, honestly believe that a single log in the sea of other console logs is equivalent as a virus?

[lvzhenbo]

Is it really just a log? What people are dissatisfied with isn't a single log, but the fact that it appears every single time it's called. Wxt generates one every time HMR is triggered. And I'm not saying the software itself is a virus, but its behavior is just like a virus. At most, I've seen npm packages output various messages after installation. I've never encountered one like dotenv that directly impacts usability. If you think this is normal, let me draw an analogy: Microsoft 365 ads are already annoying enough, but Microsoft doesn't pop up a purchase prompt every single time you save a file.

[lvzhenbo]

@aklinker1 https://nodejs.org/docs/v24.13.0/api/environment_variables.html#environment-variables

As for dependency risks, the way the dotenv author handled this will surely dampen his enthusiasm for maintaining the project. Who knows what else he might do now? This has made me less able to trust dotenv as much as before. The open-source community has plenty of similar examples.

[aklinker1]

Oh, you think he's gonna sabotage it? Like that console color library did? That would be kinda crazy lol.

I didn't dive too deep, just skimmed over the first bit of the original issue.

[lvzhenbo]

Yeah, who could have known? Trust in the open-source community is inherently fragile. We constantly hear about intentional or accidental poisoning incidents. A single vulnerability in a low-level dependency can compromise thousands of projects. Attacks targeting the npm registry happen around the clock. Even a minor tweak by the dotenv author could compromise your console's integrity. People are starting to attribute all this to AI infiltration, but is AI truly the cause? This is a profoundly complex question.

[motdotla]

I have no plans to sabotage my own library. I’m doing the opposite: using the trust dotenv has earned to point developers toward a safer, encrypted approach.

[lvzhenbo]

I have no plans to sabotage my own library. I’m doing the opposite: using the trust dotenv has earned to point developers toward a safer, encrypted approach.

The community’s response speaks for itself, doesn’t it? You’re welcome to keep adding ads to the dotenv-expand package, but that’s just simple code—in the age of AI, copying or even rewriting that code isn’t difficult.
For most use cases, an env file is simply a configuration file separated from the code, and plain text is sufficient. In scenarios with higher security requirements, env files aren’t used at all; instead, methods like system environment variables and encrypted transmission between frontend and backend are more commonly employed. Encrypting env files is redundant. I’ve rarely seen strong demands for encrypting env files in the open-source community; concerns are more often focused on vulnerabilities that could lead to the theft of secrets. If the key used to safeguard those secrets is stolen, what good are additional encryption methods?
Marketing without market demand is like handing out flyers that people just toss in the trash.

[aklinker1]

Ok, this discussion is no longer a meaningful conversation about WXT, if it ever was. Gonna lock it, probably delete it too.

@motdotla I apologize if this is your first interaction with the WXT community. I tried to keep it civil, but should have moderated this sooner.

@lvzhenbo This is not the place for you to complain about decisions you disagree with from other packages, even if WXT uses them as a dependency. If you wanted to discuss removing the dependency or some other actionable change to WXT, fine, but that clearly wasn't the intent here.

[lvzhenbo]

Another open-source tragedy