Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

111–120 of 827 posts

Re: I've Just Liberated My Modules

#111

Post by akkartik »

cballard wrote: post #71
joshmanders wrote: post #67

Earlier quoted context omitted.

Quite a bit are pretty small.

For example: http://www.scs.stanford.edu/histar/src/pkg/echo/echo.c

Erm, that's not a very good example. You're pointing out some ancient source file from back when unix had no package management. These days echo.c is part of coreutils, a large package which is economic to manage dependencies for at scale.

It's interesting to think about the distinction between promiscuous dependencies (as pioneered by Gemfile) and the Unix way. I like the latter and loathe the former, but maybe I'm wrong. Can someone think of a better example? Is there a modern dpkg/rpm/yum package with Edit: Incidentally, I just checked and echo.c in coreutils 8.25 weighs in at 194 LoC (excluding comments, empty lines and just curly braces). And that doesn't even include other files that are needed to build echo. Back in 2013 I did a similar analysis for cat, and found that it required 36 thousand lines of code (just .c and .h files). It's my favorite example of the rot at Linux's core. There's many complaints you can make about Unix package management, but 'too many tiny dependencies' seems unlikely to be one of them.

Re: I've Just Liberated My Modules

#112

Post by chrisfosterelli »

callmevlad wrote: post #59
krainboltgreene wrote: post #50

Earlier quoted context omitted.

That's not how it works. You can't publish left-pad 0.0.3 again.

Yes, but I can publish an evil left-pad@0.0.10, and if you're not shrinkwrapping or any sub-dependency has left-pad: "^0.0.3", it will pull in the evil 0.0.10 version. EDIT: I stand corrected. See below, looks that's not the case specifically for "0.0.x" versions, but gets progressively more relaxed if there's a non-zero minor version specified. However, many of the unpublished packages had varying major and minor ve…

No it won't... The caret specifier for 0.0.x packages means "this version and this version exactly".

Re: I've Just Liberated My Modules

#113

Post by Klathmon »

taumeson wrote: post #99

Wow, this is an amazing outcome here. Why is "unpublishing" something that can happen in npm? What's the point? I can see the downside, what's the upside?

A few reasons off the top of my head:

* People sometimes accidentally publish bad info. Passwords, private keys, personal information, etc... being able to remove that is a big plus

* if a critical security issue were found in a package, removing that version and adding a new one will practically "force" updates to happen.

Re: I've Just Liberated My Modules

#114

Post by vespakoen »

rybosome wrote: post #82
vespakoen wrote: post #37

Earlier quoted context omitted.

(bit offtopic) but what about: module.exports = function leftpad (str, len, ch) { return Array(len).join(ch || ' ') + String(str); };

Almost, but the existing code only pads when the str length is less than that of len.

Ahh you are right, all makes sense now, thanks!

Re: I've Just Liberated My Modules

#116

Post by mathetic »

_wmd wrote: post #73
mathetic wrote: post #30

Earlier quoted context omitted.

This is incredible. They screwed the author about ownership once and then they did exactly the same thing again.

Writing a 15 line function shouldn't grant someone the right to break an entire language ecosystem I think the real issue though here is technical - does npm really allow mutation of published assets like this? That's a shitty situation that can only lead to unreliable builds

First, you should never have a dependency for 15 lines.

Second, you sound just like people when pointed at modern art says "I could have done that" and I believe the correct response is "you didn't."

Re: I've Just Liberated My Modules

#117

Post by chc »

aioprisan wrote: post #104

If NPM wants to stay relevant and a serious contender, they need to have more clear policies in case of IP issues. In this case, the companies weren't even in the same space. Republishing someone's package who has chosen to unpublish and leave your platform is akin to Facebook resurrecting a Facebook profile because they had a lot of friends and the social circle ripple effects would be too high for feed quality for…

As best I can tell, before NPM restored it, Azer had transferred ownership to somebody else, who wanted to republish the old version but couldn't. So they do appear to be respecting the maintainer's wishes.

Re: I've Just Liberated My Modules

#118

Post by ehsanu1 »

nas wrote: post #66
aidos wrote: post #29

Earlier quoted context omitted.

I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste. The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even b…

I don't want to sound like a old grumpy man but here goes anyhow. I was looking into using node.js, react, etc after many years of writing web apps using Python and Quixote (obscure web framework like Flask). The whole Javascript technology stack looks pretty insane of me. Getting a working React environment requires a huge number of packages to be pulled down by npm. Browserify requires a bunch more. Recursive depen…

What dependencies are required? I would have thought that for basic, no-frills use, you could just load react.js and use it with no other dependencies. Are you referring to the tooling setup required for JSX? I've never used react, just curious.

Re: I've Just Liberated My Modules

#119

Post by [deleted] »

chrisfosterelli wrote: post #112
callmevlad wrote: post #59

Earlier quoted context omitted.

Yes, but I can publish an evil left-pad@0.0.10, and if you're not shrinkwrapping or any sub-dependency has left-pad: "^0.0.3", it will pull in the evil 0.0.10 version. EDIT: I stand corrected. See below, looks that's not the case specifically for "0.0.x" versions, but gets progressively more relaxed if there's a non-zero minor version specified. However, many of the unpublished packages had varying major and minor ve…

No it won't... The caret specifier for 0.0.x packages means "this version and this version exactly ".

[deleted]

Re: I've Just Liberated My Modules

#120

Post by jlarocco »

stonemetal wrote: post #53
swang wrote: post #28

Was that lawyer overreaching? I don't know. But for this guy to expect npm to use their resources to defend him (which they may even possibly lose!) and get mad at them is... a bit presumptuous? Github isn't open source either so is he going to get mad when the lawyers send them an email about kik?

If the kik in question is kik.com then >Are you a developer? Kik has open-sourced tools and libraries to help you create great web experiences that can be discovered and instantly shared by Kik's 240 million users. Rather sounds like a valid use of the law, not necessarily nice but valid. They are in the same space, open source web development.

Also, they've been around for several years, versus this guy's "kik" project which was created in late October 2015.

It seems like a legitimate complaint, IMO.

Post reply on HN