> This is not a knee-jerk action
Seems like it. Why break everyone's builds? You could just keep the modules there and then declare you will only keep them updated elsewhere?
I've Just Liberated My Modules
291–300 of 827 posts
Re: I've Just Liberated My Modules
#292Earlier quoted context omitted.
For example: http://www.scs.stanford.edu/histar/src/pkg/echo/echo.c
Erm, that's not a very good example. You're pointing out some ancient source file from back when unix had no package management. These days echo.c is part of coreutils, a large package which is economic to manage dependencies for at scale. It's interesting to think about the distinction between promiscuous dependencies (as pioneered by Gemfile) and the Unix way. I like the latter and loathe the former, but maybe I'm…
What on earth is cat doing that it needs 36KLoC (with dependencies)?
I'm starting to see where http://suckless.org/philosophy and http://landley.net/aboriginal/ are coming from (watch Rob's talks, they're very opinionated but very enjoyable).
Re: I've Just Liberated My Modules
#293Aftermath of situation from left-pad. Some says that it started to break major projects like react-native.
https://github.com/azer/left-pad/issues/4#issuecomment-20006...
Re: I've Just Liberated My Modules
#294Earlier quoted context omitted.
The author's explicit wishes, in no uncertain terms, are that anyone can "do what the fuck they want to with it" [0][1]. I think when he did this, he gave up (willingly, and with a bit of profanity) the right to have any say at all about whether, how or by whom it was published. [0] http://www.wtfpl.net/ [1] https://github.com/azer/left-pad/blob/master/package.json#L2...
The author also said "if you volunteer to take ownership of any module in my Github, I’ll happily transfer the ownership" in the blog post.
Which is a nice gesture, but since the wtfpl seems to give up any pretense of ownership on the part of the author, it's also irrelevant. Anyone can do what they want with it. If he wanted to keep tighter control of the code he should have published under a more restrictive license.
And, if he wanted people to take the time to be polite and contact him through his github account, maybe he shouldn't have wrecked so many people's builds.
Re: I've Just Liberated My Modules
#295Earlier quoted context omitted.
So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".
Looks like the npm team will not be removing the ability to unpublish packages - see reply by core committer "othiym23" on https://github.com/npm/npm/pull/12017
https://github.com/npm/npm/pull/12017#issuecomment-200131039
There are a lot of problems with NuGet, but they got this right. I do wish there was a way to mark a package as deprecated, though. For ages, there was an unofficial JQuery package that was years out of date.
Re: I've Just Liberated My Modules
#296Earlier quoted context omitted.
Well the code was open sourced. Isn't that sort of the point of open source?
Lol, so if I'm understanding you correctly: Someone was nice enough to write some software, that is clearly indispensable. They were nice enough to not charge money for it. They were nice enough to support it, again free of cost. They were also nice enough to open source it, such that if it ever became more convenient for you to fork/change/do whatever you want with, that you would be able to. And when that same pers…
If the author did not want other people to be able to fork/redistribute that code, they should not have published it under an open source license.
If they did not want other people to be able to register those package names on npm, they should not have relinquished control of them.
Re: I've Just Liberated My Modules
#297Earlier quoted context omitted.
Ahh you are right, all makes sense now, thanks!
You need to go something like: module.exports = function leftpad (str, len, ch) { return Array(Math.max(0, len - String(str).length)).join(ch || ' ') + String(str); }; Unfortunately we need to wrap str twice so maybe a one-liner is not quite in place.
The array + join is slower
http://jsperf.com/leftpadtesting
Repeat + slice is too
Re: I've Just Liberated My Modules
#298The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…
This seems like a serious security risk. Is there any solution? Would using version numbers without the caret work?
Not only is there a solution, but it's pretty well known computer science. Use public key cryptography to create a digital signature. It's not even a novel use of this -- .NET has been using this to sign assemblies and packages from day one.
Re: I've Just Liberated My Modules
#299Earlier quoted context omitted.
The author also said "if you volunteer to take ownership of any module in my Github, I’ll happily transfer the ownership" in the blog post.
Which is a nice gesture, but since the wtfpl seems to give up any pretense of ownership on the part of the author, it's also irrelevant. Anyone can do what they want with it. If he wanted to keep tighter control of the code he should have published under a more restrictive license. And, if he wanted people to take the time to be polite and contact him through his github account, maybe he shouldn't have wrecked so man…
The "ownership" I assume is referring to ownership on npm. I was just saying that, based on that excerpt from the blog post, it sounds like the author didn't actually want to keep tighter control of the code, and that re-publishing the code doesn't really go against the author's wishes.
Re: I've Just Liberated My Modules
#300Earlier quoted context omitted.
Erm, that's not a very good example. You're pointing out some ancient source file from back when unix had no package management. These days echo.c is part of coreutils, a large package which is economic to manage dependencies for at scale. It's interesting to think about the distinction between promiscuous dependencies (as pioneered by Gemfile) and the Unix way. I like the latter and loathe the former, but maybe I'm…
What on earth is cat doing that it needs 36KLoC (with dependencies)? I'm starting to see where http://suckless.org/philosophy and http://landley.net/aboriginal/ are coming from (watch Rob's talks, they're very opinionated but very enjoyable).
Yup! In fact the only other data point I have on cat is http://landley.net/aboriginal/history.html which complains about cat being over 800 lines long back in 2002 :)
I didn't dig too deeply in 2013, but I did notice that about 2/3rds of the LoC were in headers.