Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

261–270 of 827 posts

Re: I've Just Liberated My Modules

#261

Post by dham »

swang wrote: post #89
maxaf wrote: post #54

Earlier quoted context omitted.

Taking an idea to the logical extreme is an effective means of invalidating said idea. How many UNIX utilities are 17 silly lines long? A bit of code duplication would go a long way towards bringing sanity to JS land.

yes, let's blow up the entire concept that's worked fine for the ~5 years of node's existence because one dude did something extreme.

Woah woah. Hold on there. Lets not throw around strong words like "worked", "concept", "entire", "fine", "did" when discussing NPM.

Re: I've Just Liberated My Modules

#262

Post by tobltobs »

chvid wrote: post #215

I really just hope that this guy just didn't know what he was doing and what effect it would have. Otherwise it is totally irresponsible to mess up a big project like babel just because you control a few lines of trivial code.

Or is it irresponsible from the company to let loose your lawyers on a FOSS project because it uses a three letter word as a package name?

Re: I've Just Liberated My Modules

#263

Post by dantiberian »

_nfin wrote: post #130
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".

This is what happens with Clojars. It is possible to remove packages, but it requires a manual email to the admins, along with an explanation, e.g. published internal lib accidentally. This prevents scenarios like this, but also cases where people want to 'clean up' things they no longer need, even though others are depending on them.

Re: I've Just Liberated My Modules

#264

Post by vespakoen »

chvid wrote: post #220
vespakoen wrote: post #114

Earlier quoted context omitted.

Ahh you are right, all makes sense now, thanks!

You need to go something like: module.exports = function leftpad (str, len, ch) { return Array(Math.max(0, len - String(str).length)).join(ch || ' ') + String(str); }; Unfortunately we need to wrap str twice so maybe a one-liner is not quite in place.

Cool, I like the Math.max. Two liner then str = String(str);\n...

Re: I've Just Liberated My Modules

#265

Post by [deleted] »

chvid wrote: post #220
vespakoen wrote: post #114

Earlier quoted context omitted.

Ahh you are right, all makes sense now, thanks!

You need to go something like: module.exports = function leftpad (str, len, ch) { return Array(Math.max(0, len - String(str).length)).join(ch || ' ') + String(str); }; Unfortunately we need to wrap str twice so maybe a one-liner is not quite in place.

[deleted]

Re: I've Just Liberated My Modules

#266

Post by sklivvz1971 »

The problem here is that NPM is a private company in an institutional role.

You will always have some very common dependencies which, if brought down or altered, could compromise a lot of projects.

The problem is that npm has to act like an institution, not like a private company.

Re: I've Just Liberated My Modules

#267

Post by hyperpape »

wolfgke wrote: post #236
steveklabnik wrote: post #197

Earlier quoted context omitted.

My point is mostly that often, when it comes to law, lay-people talk about what they _wish_ the law was, rather than what the law actually is. And yeah, lawyers can be wrong too. But sometimes, things that seem common-sense aren't actually legally correct, and this is one of those cases. It does feel silly that a messaging company can threaten to sue over an unrelated software package, but that's just part of how int…

> My point is mostly that often, when it comes to law, lay-people talk about what they _wish_ the law was, rather than what the law actually is. That is why the law should be formalized such that correctness proofs for argumentations can be given and in doubt even be checked independently by a computer. Exactly because of the possibility of different opinions and wishes, coming up with such a high standard should be…

My background is in 20th century Anglo-American philosophy, which spent a great deal of time seeing how far one can push formalization or quasi-formalization of interesting concepts. I wish I had a good capsule version of why I think this won't work, but it won't. Formalization is a tool, and an important one, and there probably are areas where a more formal approach to law could pay off. However, attempting to remove all ambiguity, vagueness and subjectivity is liable to leave you with paradoxical results.

Perhaps you could start with this: to formalize any set of laws and criminal procedure similar to the actually existing law, you'll have to define knowledge, and that is a quagmire (http://www.unc.edu/~ujanel/Gettier.htm--you don't have to read the entire paper, but at least read the first section for a feel of how nasty the project gets. If you need more background, here is the description of what the Gettier problem is: https://en.wikipedia.org/wiki/Gettier_problem).

Re: I've Just Liberated My Modules

#268

Post by Klathmon »

Sanddancer wrote: post #252
Klathmon wrote: post #212

Earlier quoted context omitted.

IMO that doesn't change anything. The fact that in JS land it would be it's a standalone module means you get more choice in what you need (no need to pull down 100 programs if you only need 1 or 2).

You have the same amount of choice. There's no reason that you have to use the other hundred pieces of the package. In the Unix world, there's nothing precluding you from deciding to use the FreeBSD version of tar but keeping the rest of the GNU utilities there.

I guess it's a philosophical difference.

But to be fair this would have the same outcome if left-pad were part of a library that included another 50+ libs (that he also wrote and published, and subsequently un-published today).

Re: I've Just Liberated My Modules

#270

Post by wolfgke »

steveklabnik wrote: post #258
wolfgke wrote: post #236

Earlier quoted context omitted.

> My point is mostly that often, when it comes to law, lay-people talk about what they _wish_ the law was, rather than what the law actually is. That is why the law should be formalized such that correctness proofs for argumentations can be given and in doubt even be checked independently by a computer. Exactly because of the possibility of different opinions and wishes, coming up with such a high standard should be…

While I can appreciate this sentiment, I'm also not sure that removing any sort of interpretation is a good idea. Look at the horrible impact mandatory minimum sentencing has had, for example. Flexibility can be bad, but it can also be very good.

> Look at the horrible impact mandatory minimum sentencing has had, for example. Flexibility can be bad, but it can also be very good.

That is rather an argument why in doubt one should not put such harsh punishments into the law - a thesis which I support.

Post reply on HN