Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

491–500 of 827 posts

Re: I've Just Liberated My Modules

#491

Post by esailija »

karmelapple wrote: post #471
esailija wrote: post #439

Earlier quoted context omitted.

The possibility of having bugs in code you don't control (that usually has a clause for no warranties) is an argument for implementing it yourself, not against it. Don't forget how hard it is to get a maintainer even agree on whether something is 1. a bug 2. that needs to be fixed.

If someone already wrote the base code, we can always fork it and fix a bug or add a feature ourselves if it runs contrary to what the original authors desires.

Even getting a response just so you can know what the original author desires can take a long time and there is no warranties or guarantees that you will even get any response. To me, all the downsides that come with dependencies are not even close to worth it for saving 15 seconds.

Re: I've Just Liberated My Modules

#492

Post by brazzledazzle »

dwg wrote: post #177
larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

Having a multitude of small utilities like this is a great thing with many advantages. It may seem simple to write leftpad, but if 1000 projects that need it all write their own version, there will be at least 2000 more software bugs out there in the wild because of it. If you think that's rediculous, you're not being realistic about the huge disparity in skill levels of industry programmers as well as the considerab…

I'm curious since it strikes me as a hard problem to solve: How do you resolve having to deal with security issues with tens or hundreds of dependencies (and their dependencies)? How do you even know whether they have a security issue or a version bump is just a bug fix without digging into each one on a regular basis?

Re: I've Just Liberated My Modules

#493

Post by imtringued »

marcuskaz wrote: post #311
ricardobeat wrote: post #255

Earlier quoted context omitted.

Why on earth would someone pay for that if the code is already open source?

v0.0.3 is open source, though there is no license in the Github repo, so murky, but NPM says its WTFPL Since old code is under a very permissive license, then the new owner could create v0.0.4 add code and make the new version closed with a restrictive license. This is where a license like GPL would benefit overall, since all future code requires to be under the same license. Either way, it seems like a dangerous pol…

Now I'm seriously wondering if npm is a goldmine for GPL infringement. If someone has an insane dependency tree with 1000 entries then there is bound to be at least some GPL in there forcing everything else to be GPL too.

Re: I've Just Liberated My Modules

#494

Post by Grue3 »

stevebmark wrote: post #453
nas wrote: post #66

Earlier quoted context omitted.

I don't want to sound like a old grumpy man but here goes anyhow. I was looking into using node.js, react, etc after many years of writing web apps using Python and Quixote (obscure web framework like Flask). The whole Javascript technology stack looks pretty insane of me. Getting a working React environment requires a huge number of packages to be pulled down by npm. Browserify requires a bunch more. Recursive depen…

Javascript has an almost non-existent standard lib. Obviously Python ships with most of the kitchen sink in core. You're not grumpy, but you're misguided.

Why not create one big package that's a lib? Call it "batteries".

In fact, it already exists: Jquery.

Re: I've Just Liberated My Modules

#495

Post by zwetan »

funny thing, but assuming that kik is related to kik.com

if you look here http://dev.kik.com/build/, they promote their own server eg. "Our open source web server Zerver can help serve your cache manifest properly, as well as doing other speed boosting stuff like automatic style inlining."

this Zerver is on github and build with npm

https://github.com/jairajs89/zerver/blob/master/package.json

I did not run the build but I'm pretty sure that now their server is not building anymore as it depends on babel

call that irony ;) ?

Re: I've Just Liberated My Modules

#496

Post by tdicola »

imtringued wrote: post #493
marcuskaz wrote: post #311

Earlier quoted context omitted.

v0.0.3 is open source, though there is no license in the Github repo, so murky, but NPM says its WTFPL Since old code is under a very permissive license, then the new owner could create v0.0.4 add code and make the new version closed with a restrictive license. This is where a license like GPL would benefit overall, since all future code requires to be under the same license. Either way, it seems like a dangerous pol…

Now I'm seriously wondering if npm is a goldmine for GPL infringement. If someone has an insane dependency tree with 1000 entries then there is bound to be at least some GPL in there forcing everything else to be GPL too.

Exactly--there's a great bug thread on the Atom text editor where they laboriously dug through hundreds and perhaps even thousands of dependencies to see if any had licenses that were incompatible with theirs. It looked like a complete nightmare and you can see the end result if you go to the View License menu in the editor--it's hundreds of little licenses.

Re: I've Just Liberated My Modules

#497

Post by brazzledazzle »

laughinghan wrote: post #469
smsm42 wrote: post #348

Reading some of the comments reminds me old tale about a young man, that every morning on his way to work passed by a beggar and gave him a coin (that was back when coins actually had some value). One morning though the beggar notices the coin is smaller than usual, and he asks: - Why you gave me a different coin today? and the young man says: - I got married and now I'm starting a family, I need more money so I can…

Doesn't this go both ways, though? NPM developed and maintains the software and servers used to publish and serve this author's packages, bringing the author fame, glory, and as the author is demonstrating, a serious megaphone, all at no cost to the author. If the author doesn't owe NPM anything, NPM shouldn't owe the author anything even for publishing these evidently valuable packages, right?

Taking it a bit further: npm is worthless without useful modules being published. So it stands to reason that module authors should be cautious because the company that runs it clearly won't push back.

I would say that sans a cease and desist, if not a court order, they shouldn't have done anything at all. Certainly shouldn't have turned over the name to them. Better missing and breaking builds then being controlled by someone with completely different intentions.

Re: I've Just Liberated My Modules

#498

Post by Havvy »

fiatjaf wrote: post #288

Why isn't GitHub the source of all node packages? npm supports it very nicely. I mean: why don't people write `npm install user/repo --save` instead of `npm install package --save` every time already?

Because there's no version control that way. If I depended upon babel/babel (or whatever it's called on Github), when it changed from v5.x to v6.x, it would have broken my build.

Re: I've Just Liberated My Modules

#499

Post by brazzledazzle »

zwetan wrote: post #495

funny thing, but assuming that kik is related to kik.com if you look here http://dev.kik.com/build/ , they promote their own server eg. "Our open source web server Zerver can help serve your cache manifest properly, as well as doing other speed boosting stuff like automatic style inlining." this Zerver is on github and build with npm https://github.com/jairajs89/zerver/blob/master/package.json I did not run the build…

I had my suspicions that this was all motivated by wanting to grab the npm package name "kik" and the fact that they use node and npm almost cements that for me. I have a feeling this was never about protecting trademarks at all.

Re: I've Just Liberated My Modules

#500

Post by cjs2 »

smsm42 wrote: post #347
maxaf wrote: post #54

Earlier quoted context omitted.

Taking an idea to the logical extreme is an effective means of invalidating said idea. How many UNIX utilities are 17 silly lines long? A bit of code duplication would go a long way towards bringing sanity to JS land.

I wonder how long /usr/bin/true source is.

Longer than one might think...

http://git.savannah.gnu.org/cgit/coreutils.git/tree/src/true...

Post reply on HN