Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

21–30 of 827 posts

Re: I've Just Liberated My Modules

#21

Post by felixrieseberg »

Azer has contributed awesome modules to the community, but such a move _obviously_ messes with a bunch of people who previously didn't trust npm, but Azer. Npm works fine. There might be issues with it, but the reason builds are failing right now is that he decided to unpublish all of them - in a move that feels very kneejerky, despite him claiming that it's the opposite.

If this had been actually in the interest of the community (because he thinks that npm isn't acting in our interest), he'd give people a fair warning. I could have lived with a "Hey, this was my experience, it sucked, I'll unpublish things in 30 days. Please update your dependencies." We know how to deprecate things gracefully.

Re: I've Just Liberated My Modules

#22

Post by andy9775 »

chvid wrote: post #6

In case anyone is wondering what was in the now broken dependency - here is the source code in full: module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i https://github.com/azer/left-pad/blob/master/index.js

17 lines of JS causes so much havoc. Knew this would eventually happen, but I thought the code would have been more interesting

Re: I've Just Liberated My Modules

#23

Post by gnaritas »

jlg23 wrote: post #12

Seriously? "When I started coding Kik, didn’t know there is a company with same name. And I didn’t want to let a company force me to change the name of it. After I refused them, they reached NPM’s support emphasizing their lawyer power in every single e-mail CC’ing me. I was hoping that NPM would protect me, because I always believed that NPM is a nice organization." a) Ignorance is no excuse. b) Expecting others to…

> Wrong, that is the prototype of a knee-jerk action.

No it isn't; and he made that clear, he objects to their actions and is taking action of his own.

> Last but not least, whining about it in public in the hope "something will happen" is pathetic.

No, it's called protesting, and it's exactly the correct thing to do. Calling it pathetic is itself pathetic.

> hat I'd suggest (though now it is too late): Rename the module to comply with legal claims, put up a new module under the old name that throws errors when called that describe the reason so developers see it and put shame on the threatening company/lawyers.

You're completely missing his point if you think this suggestion is at all reasonable.

Re: I've Just Liberated My Modules

#24

Post by jerf »

This is why you should vendor it. What is "it"? All of it, whatever it may be. You should be able to build your systems without an internet connection to the outside world.

I say this with no reference to particulars of your language or runtime or environment or anything else. This is merely a specific example of something that could happen to a lot of people, in a lot of languages. It's just a basic rule of professional software development.

Re: I've Just Liberated My Modules

#25

Post by fogleman »

felixrieseberg wrote: post #21

Azer has contributed awesome modules to the community, but such a move _obviously_ messes with a bunch of people who previously didn't trust npm, but Azer. Npm works fine. There might be issues with it, but the reason builds are failing right now is that he decided to unpublish all of them - in a move that feels very kneejerky, despite him claiming that it's the opposite. If this had been actually in the interest of…

And we wouldn't be talking about it.

Re: I've Just Liberated My Modules

#26

Post by jlg23 »

praxulus wrote: post #15

This is a surprisingly effective protest action. It got the attention of an incredible number of people very quickly, and the damage is mostly limited to wasting the time of a bunch of build cops. I don't have much of an opinion on his actual reasons for protesting, but I do think it was a pretty cool protest.

EDIT: For those with a short attention span, the first paragraph is a drastic metaphor, the second is making my point.

If a kid does not get cookies at home it can shoot all its classmates. Lots of media coverage, the kid will get "the attention of an incredible number of people very quickly".

NO.

For me, publishing code under a FOSS-license means giving back to the community. Anyone who then decides to cause collateral damage in that community was never in for the community in first place. Sorry, that sucks. It causes extra work to developers who rely on your code. They have to spend time to fix a non-issue. Time they could spend with friends and families. If I was a js-coder, the author would be blacklisted for life. If I was an employer, the author would not get permission to publish code created during work hours under a FOSS-license without the company having a private repo. Such a reaction actually costs real money to lots of people. And it is a great disservice to the FOSS-community because it sets a precedent.

Re: I've Just Liberated My Modules

#28

Post by swang »

Was that lawyer overreaching? I don't know. But for this guy to expect npm to use their resources to defend him (which they may even possibly lose!) and get mad at them is... a bit presumptuous? Github isn't open source either so is he going to get mad when the lawyers send them an email about kik?

Re: I've Just Liberated My Modules

#29

Post by aidos »

chvid wrote: post #6

In case anyone is wondering what was in the now broken dependency - here is the source code in full: module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i https://github.com/azer/left-pad/blob/master/index.js

I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste.

The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even be possible to revoke an old version that's depended on by other libs?

These few lines of js cost me a couple of hours tonight! :-/

Re: I've Just Liberated My Modules

#30

Post by mathetic »

cammsaul wrote: post #8

Update: NPM takes "unprecidented action [...] given the severity and widespread nature of the breakage" and un-un-publishes left-pad https://twitter.com/seldo/status/712414400808755200

This is incredible. They screwed the author about ownership once and then they did exactly the same thing again.
Post reply on HN