Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

391–400 of 827 posts

Re: I've Just Liberated My Modules

#391

Post by steveklabnik »

krapp wrote: post #388
BinaryIdiot wrote: post #373

Earlier quoted context omitted.

Yeah I get the "do whatever the fuck you want" but in a legal sense I wasn't sure that could (or did) include actual ownership. I thought that had more to do with copyright and any other IP transferring. Then again I also said I had no idea :)

The more I think about this license, the more I wonder if it's even legally enforceable. How do you enforce a license whose only terms are that it has no terms?

The WTFPL's own website mentions that it's never been tested in court.

Re: I've Just Liberated My Modules

#392

Post by voltagex_ »

akkartik wrote: post #300
voltagex_ wrote: post #292

Earlier quoted context omitted.

What on earth is cat doing that it needs 36KLoC (with dependencies)? I'm starting to see where http://suckless.org/philosophy and http://landley.net/aboriginal/ are coming from (watch Rob's talks, they're very opinionated but very enjoyable).

Yup! In fact the only other data point I have on cat is http://landley.net/aboriginal/history.html which complains about cat being over 800 lines long back in 2002 :) I didn't dig too deeply in 2013, but I did notice that about 2/3rds of the LoC were in headers.

>"When I looked at the gnu implementation of the "cat" command and found out its source file was 833 lines of C code (just to implement _cat_), I decided the FSF sucked at this whole "software" thing. (Ok, I discovered that reading the gcc source at Rutgers back in 1993, but at the time I thought only GCC was a horrible bloated mass of conflicting #ifdefs, not everything the FSF had ever touched. Back then I didn't know that the "Cathedral" in the original Cathedral and the Bazaar paper was specifically referring to the GNU project.)"

Re: I've Just Liberated My Modules

#393

Post by michaeldwan »

larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

"A little copying is better than a little dependency" - Rob Pike

Re: I've Just Liberated My Modules

#394

Post by dylan-m »

Sanddancer wrote: post #196
cballard wrote: post #141

Earlier quoted context omitted.

Why would this be a bad thing? I don't need a random number generator if I just want to allocate memory.

Because a lot of little libraries makes namespaces more complicated, makes security auditing more difficult, makes troubleshooting more difficult as you have to start digging through compatibility of a ton more libraries, makes loading slower, because you have to fopen() a ton more files and parse their contents, etc. Add on top of that those little libraries needing other, probably redundant little libraries, and yo…

Not to mention maintenance. Low-hanging fruit here: left-pad, depended on by fricking everyone, is owned by one guy. That is not how you build a serious utility library that people should actually be using in real products. (You also probably shouldn't license it under the WTFPL, but that's another thing). When you aggregate under a common banner, you get maintainers for free and your project might have a bus factor better than 1.

Re: I've Just Liberated My Modules

#395

Post by kzrdude »

krainboltgreene wrote: post #310
kzrdude wrote: post #179

Earlier quoted context omitted.

Obviously not your choice, but it's a problem of using 0.0.x versions; no flexibility for the crate author to push minor updates.

That's absolutely not true.

The fact that so many depend on exactly the version 0.0.3 indicates it is.

What if it were 0.3.0 instead? The common dependency relation would allow 0.3.1 too and allow you to easily deliver a minor update.

Re: I've Just Liberated My Modules

#396

Post by kylecordes »

nyan4 wrote: post #276
nas wrote: post #66

Earlier quoted context omitted.

I don't want to sound like a old grumpy man but here goes anyhow. I was looking into using node.js, react, etc after many years of writing web apps using Python and Quixote (obscure web framework like Flask). The whole Javascript technology stack looks pretty insane of me. Getting a working React environment requires a huge number of packages to be pulled down by npm. Browserify requires a bunch more. Recursive depen…

> Recursive dependency resolution is nice and all but isn't this going to create a massive technological debt that needs to be maintained? Spot on. Imagine deploying an application, in 2018, that pulls down 1000 libraries, 300 of which are 6 years old versions and contain vulnerabilities (or just bugs) involving data on transit. Who is going to do all the work to backport fixes in every affected version of each libra…

If things continue on the current path, I would be surprised if a typical 2018 node/NPM-based application only pulled in 1000 libraries (transitively). I just checked an application under development here:

$ ls node_modules | wc -l 517

Then I checked the current Angular 2 repository:

$ ls node_modules | wc -l 804

(Kudos to NPM 3 for finally flattening node_modules; in addition to reducing duplication and making life less miserable on Windows, it is now much more obvious how the transitive dependencies explode.)

Given the ongoing trend toward each dependency having more dependencies of its own, 1000 doesn't sound like much of a stretch. How many of those 1000+ will be up to date and lacking in critical security or functionality bugs? It sure won't be 100%.

It makes me look longingly at languages which ship with a reasonable standard library.

Re: I've Just Liberated My Modules

#397

Post by indiv0 »

patio11 wrote: post #385
Joky wrote: post #350

Earlier quoted context omitted.

I'm not sure how the court could force you to do something you can't possibly do...

"So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct." "You're being honest with me." "Yes, your Honor." "Will the computers continue harming the plaintiff's interests if shut off?" "... That would be dreadfully inconvenient, your Honor." "Do you have a more convenient solution?" "No, your Honor." "You are hereby ordered to turn off your computers…

How about a blockchain-based NPM? Can't take all the computers down.

Legal, shmegal.

Re: I've Just Liberated My Modules

#398

Post by kemitchell »

voltagex_ wrote: post #295
callmevlad wrote: post #173

Earlier quoted context omitted.

Looks like the npm team will not be removing the ability to unpublish packages - see reply by core committer "othiym23" on https://github.com/npm/npm/pull/12017

https://github.com/npm/npm/pull/12017#issuecomment-200131039 There are a lot of problems with NuGet, but they got this right. I do wish there was a way to mark a package as deprecated, though. For ages, there was an unofficial JQuery package that was years out of date.

`npm help deprecate`

Re: I've Just Liberated My Modules

#399

Post by nirvdrum »

sbuttgereit wrote: post #245

I've been reading in the comments regarding 1) the practical effect of breaking builds and 2) the security issues of how package names can be reused on npm once they are unpublished (versioning aside for a moment). I wonder what other, similar, packaging distribution platforms are vulnerable to this sort of thing? I am not speaking from knowledge of any of the procedures of any of those I'm about to mention, but I ha…

I've had deploys break because gems were removed from RubyGems.org. Using CI as a gate isn't sufficient because a gem can be removed in the window between a completed CI run and the deploy. Making it harder, generally if you have a gem installed locally you won't notice the problem until you need to install it on a fresh system.

It used to be the case that a yanked gem was simply removed from the gem index, but the file was still published, so you'd still be able to install it. Now the gems are deleted, eliminating that option.

So, other systems are definitely susceptible and it does burn people. I just don't think we've seen an issue on this scale yet. The largest I've hit have been when the twitter gem was yanked in advance of Twitter's shutdown, a fog-XYZ gem being yanked as new versions were released, and at least one yanked version of net-ssh.

The only really effective way to avoid this is to mirror all your dependencies yourself (and not honor upstream yanks) or vendor all your gems. I know of exceedingly few people doing this.

I've yet to encounter a legitimate cause for a yanked gem. But I worry more that a bad actor gains credentials to a high profile account and just wreaks havoc on the ecosystem. On that note, I have found and reported users that've committed their RubyGems.org credentials to GitHub in a "dotfiles" repository.

Re: I've Just Liberated My Modules

#400

Post by spinlock »

smt88 wrote: post #384
gpm wrote: post #349

Earlier quoted context omitted.

> That's not necessarily true if Kik were planning to open up some kind of API. Surely opening up a new API doesn't give them retroactive rights to the name in that space.

As someone pointed out in another thread, you similarly couldn't name a package something like "facebook" even if Facebook had no API.

facebook may be a bad example. they named themselves after a generic directory that many colleges have been giving out for decades.
Post reply on HN