Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

61–70 of 827 posts

Re: I've Just Liberated My Modules

#61

Post by Klathmon »

larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

Personally i'm going to use an installable module for something even that small, because i can, and it works.

The benefits from an install registry don't go away just because the module is very tiny...

Why would i spend my time re-inventing the wheel for every little thing i do? And if i'm not reinventing, then i'd be copy/pasting which is much worse. At best that's a waste of time and effort to properly document the source, and at worst it's stealing or license violations.

I don't care if a module is a single line, if it does what i need it to and is well tested, then i'll use it. That might seem silly, but the fact is that it's pretty much no overhead, and no software is immune from bugs (even a 16 line function), so updates might be useful in the future.

Yeah, there is a chance that stuff like this can happen, but within an hour there were several alternatives to solve issues with installs, i'd say the system is working pretty well. Plus with proper software development techniques (like vendoring your dependencies) this wouldn't even be a problem at all.

Re: I've Just Liberated My Modules

#62

Post by peterkelly »

spdustin wrote: post #38
cammsaul wrote: post #8

Update: NPM takes "unprecidented action [...] given the severity and widespread nature of the breakage" and un-un-publishes left-pad https://twitter.com/seldo/status/712414400808755200

This feels very wrong to me. I know, open source, etc., and it's likely that the source license allows it provided the license remain intact, but still... For better or worse (worse, IMHO), the author decided to un-publish his nam modules. He asserted his authority over that package of his code. For npm to usurp his authority, even if the licensing allows it, feels wrong .

By choosing to publish his work as open source, he made it possible for npm to do this. One of the great things about open source licenses if that the original author decides to remove their work (regardless of whether on valid grounds or not), the community can still access it.

If he wanted the ability to prevent who is able to reuse and distributed his code, a proprietary license would have been a more suitable choice.

Re: I've Just Liberated My Modules

#63

Post by cballard »

larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

> Developers: less dependencies is better, especially when they're so simple!

No! The opposite of that. Lots of little µframeworks, defining composable and generic types, is much better than a giant monolith.

The Swift Package Manager is taking this approach, and I think it's great: https://github.com/apple/swift-package-manager#modules

The caret character doesn't appear anywhere in the semver spec, so whatever that does, it's non-standard: http://semver.org/

If your modules are small and well-defined, they probably won't need many versions anyways - they might just stay on 1.0.x forever. If you want to do something different, it might make more sense to just write another module.

Re: I've Just Liberated My Modules

#64

Post by adrinavarro »

cyphar wrote: post #18

Seems odd that a patent lawyer is being involved in a trademark dispute. Also, given the fact that he didn't make any money off it, I severely doubt that it would ever go to court.

If you ask me, I'd bet that it's because the brand behind the 'concerned' trademark is up to something and they are just doing their homework.

Re: I've Just Liberated My Modules

#65

Post by linksbro »

MaulingMonkey wrote: post #41
gnaritas wrote: post #23

Earlier quoted context omitted.

> Wrong, that is the prototype of a knee-jerk action. No it isn't; and he made that clear, he objects to their actions and is taking action of his own. > Last but not least, whining about it in public in the hope "something will happen" is pathetic. No, it's called protesting, and it's exactly the correct thing to do. Calling it pathetic is itself pathetic. > hat I'd suggest (though now it is too late): Rename the mo…

> You're completely missing his point if you think this suggestion is at all reasonable. Is this the kik we're talking about? http://dev.kik.com/ https://trademarks.justia.com/858/93/kik-85893307.html Is the point that kik should just give up on their company trademark?

Just because they've trademarked "kik" doesn't give them complete control over all instances of that 3 letter string in the world. See the 8 factors of trademark infringement, and trademark law in general; this is just a kik lawyer being threat happy.

Re: I've Just Liberated My Modules

#66

Post by nas »

aidos wrote: post #29
chvid wrote: post #6

In case anyone is wondering what was in the now broken dependency - here is the source code in full: module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i https://github.com/azer/left-pad/blob/master/index.js

I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste. The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even b…

I don't want to sound like a old grumpy man but here goes anyhow. I was looking into using node.js, react, etc after many years of writing web apps using Python and Quixote (obscure web framework like Flask). The whole Javascript technology stack looks pretty insane of me. Getting a working React environment requires a huge number of packages to be pulled down by npm. Browserify requires a bunch more. Recursive dependency resolution is nice and all but isn't this going to create a massive technological debt that needs to be maintained? Semver is not a magic bullet.

Also, seems like a security disaster waiting to happen (I don't use CDN because I like to make sure I review code before putting it on my important websites). Linux distributions like Debian have put in huge effort into making a packaging system that is secure and doesn't lead to dependency hell. You can argue how successful they have been but, and maybe I'm ignorant, I don't see the same effort and level of maturity in the Javascript/npm ecosystem.

As an alternative to React, I'm looking at Mithril. It's relatively small and has no dependencies. I'm quite a bit more comfortable building on that foundation as opposed to a giant house of cards.

Re: I've Just Liberated My Modules

#67

Post by joshmanders »

maxaf wrote: post #54
joshmanders wrote: post #45

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Unix_philosophy

Taking an idea to the logical extreme is an effective means of invalidating said idea. How many UNIX utilities are 17 silly lines long? A bit of code duplication would go a long way towards bringing sanity to JS land.

Quite a bit are pretty small.

Re: I've Just Liberated My Modules

#68

Post by kasey_junk »

aidos wrote: post #32
kofejnik wrote: post #27

this is why your dependencies should be checked into git

Then how can you ever install anything in the first place?

Having no understanding of the broader js context I assumed the comment to mean "all library dependencies should be checked in, build tools should be defined & specified & able to fully recreate the build given they are installed".

For the record this is a well known & frequently advocated for build pattern.

Re: I've Just Liberated My Modules

#69

Post by detaro »

Etheryte wrote: post #57
mathetic wrote: post #30

Earlier quoted context omitted.

This is incredible. They screwed the author about ownership once and then they did exactly the same thing again.

Yes, I was rather neutral at first, but this is a complete dick move on NPM's behalf. Essentially they've just given the module to another owner.

If you delete a module, the name becomes free. Someone else grabbed it and publishing code he has a license to redistribute under it. NPM is "only" fudging with the version number, the author gave the module away.

Re: I've Just Liberated My Modules

#70

Post by swang »

spdustin wrote: post #38
cammsaul wrote: post #8

Update: NPM takes "unprecidented action [...] given the severity and widespread nature of the breakage" and un-un-publishes left-pad https://twitter.com/seldo/status/712414400808755200

This feels very wrong to me. I know, open source, etc., and it's likely that the source license allows it provided the license remain intact, but still... For better or worse (worse, IMHO), the author decided to un-publish his nam modules. He asserted his authority over that package of his code. For npm to usurp his authority, even if the licensing allows it, feels wrong .

Nope, nothing wrong. The code he wrote is his, but he doesn't own the npm namespace, which is all anyone cares about here at this point.

But you know what also _feels_ wrong? people who had no involvement in this at all having their day get fucked up because of this one dude who _suddenly_, just now realized that npm isn't going to really help him out and did the internet equivalent of taking your ball and going home.

Post reply on HN