Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Auto install npm dependencies as you code

npmjs.com

Post reply on HN
Print view View original

71–80 of 80 posts

Re: Show HN: Auto install npm dependencies as you code

#71

Post by siddharthkp »

cortesoft wrote: post #46
siddharthkp wrote: post #44

Earlier quoted context omitted.

Good point, any ideas on handling this better? Opened an issue here: https://github.com/siddharthkp/auto-install/issues/2

I don't really know if there is a way to fix this issue... unless you had some sort of whitelist of acceptable packages, and a prompt if you try to install a non-whitelisted package. One other possibility is to have a delay, so that it waits an amount of time before installing, to give a chance to catch and fix the typo.

Added a --secure flag which will install popular modules only (>10k downloads last month)

Re: Show HN: Auto install npm dependencies as you code

#72

Post by cortesoft »

siddharthkp wrote: post #71
cortesoft wrote: post #46

Earlier quoted context omitted.

I don't really know if there is a way to fix this issue... unless you had some sort of whitelist of acceptable packages, and a prompt if you try to install a non-whitelisted package. One other possibility is to have a delay, so that it waits an amount of time before installing, to give a chance to catch and fix the typo.

Added a --secure flag which will install popular modules only (>10k downloads last month)

Good idea!

Re: Show HN: Auto install npm dependencies as you code

#73

Post by randallsquared »

Etzos wrote: post #18
randallsquared wrote: post #3

Given that in npm v3 the order of installation determines where things are installed, this seems like it might cause some interesting bugs that never happen on the developer's machine. :)

I'm not sure how this could happen as one shouldn't be depending on the directory structure in the node_modules/ folder anyway. Do you have an example of where this might cause issues?

Well, one shouldn't... :)

I don't actually know that there's any problem that `rm node_modules; npm install` won't solve, since that would make things the same as a fresh install.

All of the scenarios I could come up with were about long-running installs, rather than new deploys, so more likely to happen on dev than prod.

ETA: actually wrong, see below.

Re: Show HN: Auto install npm dependencies as you code

#74

Post by Etzos »

randallsquared wrote: post #73
Etzos wrote: post #18

Earlier quoted context omitted.

I'm not sure how this could happen as one shouldn't be depending on the directory structure in the node_modules/ folder anyway. Do you have an example of where this might cause issues?

Well, one shouldn't ... :) I don't actually know that there's any problem that `rm node_modules; npm install` won't solve, since that would make things the same as a fresh install. All of the scenarios I could come up with were about long-running installs, rather than new deploys, so more likely to happen on dev than prod. ETA: actually wrong, see below.

I can't think of any scenario when one would be relying on a specific structure being in the node_modules/ directory. And if there is such a need, then it's likely the code is doing something very strange or very special in which case this kind of package would not even be considered during creation (and I still think wouldn't cause problems).

Even in long-running installs I still don't see a potential issue here. Do you have a small specific example you can think of?

Re: Show HN: Auto install npm dependencies as you code

#75

Post by randallsquared »

Etzos wrote: post #74
randallsquared wrote: post #73

Earlier quoted context omitted.

Well, one shouldn't ... :) I don't actually know that there's any problem that `rm node_modules; npm install` won't solve, since that would make things the same as a fresh install. All of the scenarios I could come up with were about long-running installs, rather than new deploys, so more likely to happen on dev than prod. ETA: actually wrong, see below.

I can't think of any scenario when one would be relying on a specific structure being in the node_modules/ directory. And if there is such a need, then it's likely the code is doing something very strange or very special in which case this kind of package would not even be considered during creation (and I still think wouldn't cause problems). Even in long-running installs I still don't see a potential issue here. Do…

Package A depends on lodash: ^4.6.1

Package B depends on lodash: ^4.14.2

... you know what? I just installed semver to check my beliefs, and it turns out I'm just spreading FUD. Caret doesn't work the way I thought it did.

Please disregard.

Re: Show HN: Auto install npm dependencies as you code

#76

Post by tomc1985 »

siddharthkp wrote: post #30
tomc1985 wrote: post #12

Dependency installation should be a bit frictional...

That's interesting, tell me more?

As the other comments here have alluded,

a) a typo can run unintended code on your box

b) a bad/old/hacked project (correctly typed) can run unintended code on your box

c) both of the above conditions are considerably more severe because they can be triggered with near-zero friction (unlike a gemfile, which are manually pulled-down and code is run from a separate command. Gemfile results are also generally small enough (1-2 pages) that one can visually spot typos if you are monitoring the output

d) complex dependency systems can often turn into dependency hell

e) (IMHO) instantly-available dependencies potentially reduce a given programmer's likelihood to attempt to solve their problems with the language itself (i.e. don't use Cassandra when a Dictionary will do) ... the nodejs community seems especially susceptible to this

That's all I can think of right now...

Re: Show HN: Auto install npm dependencies as you code

#77

Post by primemotile »

yladiz wrote: post #52
primemotile wrote: post #45

Earlier quoted context omitted.

Exactly how is any of this different than installing via the command line?

Because it installs based on what you type, if you accidentally type something like `expres`, which has some kind of vulnerability or is malicious, you won't have time to notice the typo before it installs it. It could happen when doing it manually, but it's less likely because it doesn't install based on looking at your code but based on your `npm install` command.

I'm not buying the argument. I often hit [npm install] 20 times a day, and sometimes you get distracted, or just sloppy at the end of a long week. A nice feature of this, is in vim I'd have a dict of common modules, and then have the autocomplete autocomplete their names for me. That way you get in a routine where if the library isn't in the autocomplete, you need to take a second and think about it. So nothing wrong with the tool, it's just a tool. Use a flamethrower carelessly, you're going to have a bad time.

Re: Show HN: Auto install npm dependencies as you code

#79

Post by siddharthkp »

mxstbr wrote: post #78
siddharthkp wrote: post #70

Thanks for pointing out the obvious risks due to typos. Added a --secure flag which will install popular modules only (>10k downloads last month) `auto-install --secure`

That's one fast response time! Awesome!

;)

Re: Show HN: Auto install npm dependencies as you code

#80

Post by tomc1985 »

dozzie wrote: post #64
dack wrote: post #41

Earlier quoted context omitted.

I could be wrong, but I think he might mean that people should take care not to add too many dependencies to their project - if it's too easy, then it might result in unnecessary dependencies and brittle code. However, I'm not sure I agree with the statement - you could use this tool and still have the discipline not to pull in random packages.

The idea is that people in general go down the currently-easier way, which is "add the dependency", leading to microdependencies and left-pad idiocy in npm case. If there is a friction, the balance is changed a little against pulling dependencies, at least those most trivial.

This!
Post reply on HN