Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

31–40 of 827 posts

Re: I've Just Liberated My Modules

#31

Post by larkinrichards »

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this.

It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code?

  module.exports = leftpad;
  
  function leftpad (str, len, ch) {
    str = String(str);
  
    var i = -1;
  
    if (!ch && ch !== 0) ch = ' ';
  
    len = len - str.length;
  
    while (++i
Developers: less dependencies is better, especially when they're so simple!

You know what's also awesome? The caret semver specifier[1]. You could install a new, broken version of a dependency doing that-- especially when other packages using peerDependencies rely on specific versions and you've used a caret semver specifier.

[1] https://github.com/lydell/line-numbers/pull/3/files

Re: I've Just Liberated My Modules

#33

Post by Klathmon »

jerf wrote: post #24

This is why you should vendor it. What is "it"? All of it, whatever it may be. You should be able to build your systems without an internet connection to the outside world. I say this with no reference to particulars of your language or runtime or environment or anything else. This is merely a specific example of something that could happen to a lot of people, in a lot of languages. It's just a basic rule of professi…

I agree. I use and love NPM and others like it, but when it comes down to it, i check-in my dependencies when my applications get "released".

Committing the updates is only one more step, and in my experience it's not even another step since we already have a rule that new installs or dep updates need their own commit.

Re: I've Just Liberated My Modules

#34

Post by celtain »

jlg23 wrote: post #26
praxulus wrote: post #15

This is a surprisingly effective protest action. It got the attention of an incredible number of people very quickly, and the damage is mostly limited to wasting the time of a bunch of build cops. I don't have much of an opinion on his actual reasons for protesting, but I do think it was a pretty cool protest.

EDIT: For those with a short attention span, the first paragraph is a drastic metaphor, the second is making my point. If a kid does not get cookies at home it can shoot all its classmates. Lots of media coverage, the kid will get "the attention of an incredible number of people very quickly". NO. For me, publishing code under a FOSS-license means giving back to the community. Anyone who then decides to cause collate…

I think you missed the caveat about the actual damage caused. Wasting people's time is nowhere close to murder.

Re: I've Just Liberated My Modules

#35

Post by oldmanjay »

gnaritas wrote: post #23
jlg23 wrote: post #12

Seriously? "When I started coding Kik, didn’t know there is a company with same name. And I didn’t want to let a company force me to change the name of it. After I refused them, they reached NPM’s support emphasizing their lawyer power in every single e-mail CC’ing me. I was hoping that NPM would protect me, because I always believed that NPM is a nice organization." a) Ignorance is no excuse. b) Expecting others to…

> Wrong, that is the prototype of a knee-jerk action. No it isn't; and he made that clear, he objects to their actions and is taking action of his own. > Last but not least, whining about it in public in the hope "something will happen" is pathetic. No, it's called protesting, and it's exactly the correct thing to do. Calling it pathetic is itself pathetic. > hat I'd suggest (though now it is too late): Rename the mo…

He made it clear he doesn't want to consider it a knee jerk, which has approximately zero relationship to whether it actually is.

Protesting trademark law sounds like a lot of useless fun. It may be the "correct" thing to do, but it will have no result.

Re: I've Just Liberated My Modules

#37

Post by vespakoen »

chvid wrote: post #6

In case anyone is wondering what was in the now broken dependency - here is the source code in full: module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i https://github.com/azer/left-pad/blob/master/index.js

(bit offtopic) but what about:

module.exports = function leftpad (str, len, ch) { return Array(len).join(ch || ' ') + String(str); };

Re: I've Just Liberated My Modules

#38

Post by spdustin »

cammsaul wrote: post #8

Update: NPM takes "unprecidented action [...] given the severity and widespread nature of the breakage" and un-un-publishes left-pad https://twitter.com/seldo/status/712414400808755200

This feels very wrong to me. I know, open source, etc., and it's likely that the source license allows it provided the license remain intact, but still... For better or worse (worse, IMHO), the author decided to un-publish his nam modules. He asserted his authority over that package of his code. For npm to usurp his authority, even if the licensing allows it, feels wrong.

Re: I've Just Liberated My Modules

#39

Post by jsprogrammer »

jlg23 wrote: post #12

Seriously? "When I started coding Kik, didn’t know there is a company with same name. And I didn’t want to let a company force me to change the name of it. After I refused them, they reached NPM’s support emphasizing their lawyer power in every single e-mail CC’ing me. I was hoping that NPM would protect me, because I always believed that NPM is a nice organization." a) Ignorance is no excuse. b) Expecting others to…

There are no legal claims to be made over NPM package names. NPM has a policy for assigning names and third party attorneys don't get a say.

Are you serious?

>Seriously

Re: I've Just Liberated My Modules

#40

Post by dc2 »

> This is not a knee-jerk action.

The only thing knee-jerk and honestly irresponsible is not warning anyone first, especially knowing how much his modules were depended upon.

Otherwise, there's nothing wrong with this.

Post reply on HN