Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

331–340 of 827 posts

Re: I've Just Liberated My Modules

#331

Post by dclowd9901 »

JeremyBanks wrote: post #329
dclowd9901 wrote: post #322

While I don't disagree with OP's angst, fuck them for choosing pride over working products. It's irresponsible and shows a complete lack of maturity. I'll make sure never to consume their modules in the future. God forbid they have a bad day and decides to insert malicious code into their modules.

You should greatly thank him for highlighting the flaws in your system if this caused significant issues.

What he did is analogous to someone breaching a trust system by doing something untrustworthy. If the argument is we shouldn't have trust systems, fucking bravo. Isn't the world a great place?

Re: I've Just Liberated My Modules

#332

Post by joeandaverde »

Here's a highly downloaded 11 line module with lots of dependents.

https://www.npmjs.com/package/escape-string-regexp

I stopped searching at 1.

I've certainly benefitted from the vast ecosystem of npm. I greatly appreciate the work that goes into making this ecosystem what it is. However, I think we need to be a bit more critical when it comes to acquiring dependencies. Especially authors of very prominent packages.

Fun fact: one of my projects (a web api) depends on over 700 unique name/version modules.

Fellow programmers. This is embarrassing.

Re: I've Just Liberated My Modules

#333

Post by Will_Do »

nas wrote: post #155
ehsanu1 wrote: post #118

Earlier quoted context omitted.

What dependencies are required? I would have thought that for basic, no-frills use, you could just load react.js and use it with no other dependencies. Are you referring to the tooling setup required for JSX? I've never used react, just curious.

react_demo$ du -sh node_modules/ 25M node_modules/ react_demo$ ls node_modules/|wc -l 79 react_demo$ cat $(find node_modules/ -type f ) | wc -l 287767 I think I installed react, react-dom, browserify (globally), babel. The exact details are not really important, being inexperienced with react I probably installed stuff that is not strictly necessary. However, the ease of pulling in a huge amount of dependent code mak…

That's amazing. I had no idea things were so bad.

Re: I've Just Liberated My Modules

#334

Post by spdustin »

alextgordon wrote: post #221
spdustin wrote: post #153

Earlier quoted context omitted.

Agreed, that feels wrong too. But is npm supposed to be the recess supervisor in this metaphor, taking the ball back and giving it back to the other kids?

If he wants to control where people get his software, he should have published it under a proprietary license. Not saying he does, though.

Fair enough. I would posit that he didn't ever expect that the npm folks would undo his actions, even if his decisions were/seemed rash.

Re: I've Just Liberated My Modules

#335

Post by bluefox »

fungi wrote: post #313
bluefox wrote: post #214

Earlier quoted context omitted.

This is a very good question. I was going to make the argument that the author merely continued what NPM Inc. started, and that if you fault him, you should also fault NPM Inc., but then I noticed that NPM Inc. didn't unpublish his module, but transfered the name to another account, which is much worse, if you think about it. The ultimate conclusion is that if it's anyone's fault, it is the fault of the person who re…

couple of days ago i was all smug from upvotes for calling npm best practise. i take that back, npm is a security risk that should be avoided. now i need a new package manager.

Notice that I didn't talk about the node package manager, but about the author and the company NPM Inc. (and their registry service).

It's not that your "build got broken", it's that you had a broken build process. You are the one at fault. You chose (perhaps unconciously) to rely on various entities, their services, their whims, and they proved to be unreliable.

The simplest solution for those who write an application is to commit the dependencies into the repository as well. This significantly lowers the amount of entities relied upon when building it. (Alternatively, have your own registry, whatever.)

Then you can discuss issues like the ideal module granularity, ethics of this or that actor, names and trademarks, etc. without worrying about your "broken build".

Re: I've Just Liberated My Modules

#336

Post by mjrbrennan »

octref wrote: post #328

Why don't people just use lodash? https://lodash.com/docs#padStart It's well-tested, well-maintained, performant, with good documentation and has custom-build to leave out functions you don't need.

I had that same thought the other day. We are ending up with thousands of 11-line "micro-libraries" that just cause huge dependency issues and have limited usefulness. Like you said, lodash is well-tested, well-maintained and performant with good docs. So why isn't it just used more by these libraries? It shouldn't be a size problem either, if you really want to you can require individual lodash functions in node.

Re: I've Just Liberated My Modules

#337

Post by delinka »

jessaustin wrote: post #315
delinka wrote: post #307

Earlier quoted context omitted.

So, in your opinion, if I built a software application that let you design and order plate glass in decorative form to be placed in the walls of your house and named this app "Windows" would Microsoft's inevitable attempts at protecting their trademark be overreaching? The windows I named my app for are physical things and Microsoft's are virtual, but I'm releasing a software product called "Windows." Both kik names…

Yes, even this faintly ridiculous fake example of painstaking mental construction would be overreach. No one would ever download your hypothetical architectural software expecting to get an operating system. As a public service, some toilet or compost bin manufacturer ought to start "violating" trademarks by naming toilets etc. after litigious companies. We'd all get a kik out of hearing them argue that database cons…

People with experience in software wouldn't likely confuse the two pieces of software. But most people think "computers" and stop there. Most people visiting an app store would see "Windows" for 99 cents, buy it, then complain when it wasn't Microsoft Windows. They wouldn't read descriptions, and they don't know what an operating system is.

Confusion. Microsoft is very likely to prevail in the infringement lawsuit.

Re: I've Just Liberated My Modules

#339

Post by minitech »

yazaddaruvala wrote: post #281
camwest wrote: post #232

Earlier quoted context omitted.

Well the code was open sourced. Isn't that sort of the point of open source?

Lol, so if I'm understanding you correctly: Someone was nice enough to write some software, that is clearly indispensable. They were nice enough to not charge money for it. They were nice enough to support it, again free of cost. They were also nice enough to open source it, such that if it ever became more convenient for you to fork/change/do whatever you want with, that you would be able to. And when that same pers…

Hah, “indispensable”. It pads strings. Here, I wrote an alternative:

  function padLeft(s, width, padCharacter) {
      var d = width - s.length;

      return d

Re: I've Just Liberated My Modules

#340

Post by overgard »

aeze wrote: post #239
overgard wrote: post #77

I think it's amusing to see this from the perspective of the company. Some guy uses your trademark without your permission so you tell him to knock it off. He refuses, so you go around him, and so he protests... by fucking over all of his users. In a dispute that doesn't involve them. And people are celebrating this.

Aren't trademarks only relevant to products or services?

kik.com is a product/service. kik the library is a product/service.
Post reply on HN