Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

541–550 of 827 posts

Re: I've Just Liberated My Modules

#541

Post by callumlocke »

sorenjan wrote: post #346
dwg wrote: post #177

Earlier quoted context omitted.

Having a multitude of small utilities like this is a great thing with many advantages. It may seem simple to write leftpad, but if 1000 projects that need it all write their own version, there will be at least 2000 more software bugs out there in the wild because of it. If you think that's rediculous, you're not being realistic about the huge disparity in skill levels of industry programmers as well as the considerab…

I've never used npm, but doesn't it take at least as long to find, evaluate, and install a package like left-pad as it would to just write the function yourself when you find you need it?

No. I could find, evaluate and install that package quicker than I could write the code that carefully. And the second time I need it, it's just "remember, install". Also, keeps my code small and focused.

Re: I've Just Liberated My Modules

#542

Post by beejiu »

esailija wrote: post #439
karmelapple wrote: post #406

Earlier quoted context omitted.

Personally, no, but even if it did, what if a bug is found in the future? The community fixes the bug, not necessarily you!

The possibility of having bugs in code you don't control (that usually has a clause for no warranties) is an argument for implementing it yourself, not against it. Don't forget how hard it is to get a maintainer even agree on whether something is 1. a bug 2. that needs to be fixed.

The reality, however, is that if you took this point of view, you will spend your time reinventing the wheel, introducing bugs and wasting resources. That's how it works in real life.

Re: I've Just Liberated My Modules

#543

Post by [deleted] »

viraptor wrote: post #430
Sanddancer wrote: post #196

Earlier quoted context omitted.

Because a lot of little libraries makes namespaces more complicated, makes security auditing more difficult, makes troubleshooting more difficult as you have to start digging through compatibility of a ton more libraries, makes loading slower, because you have to fopen() a ton more files and parse their contents, etc. Add on top of that those little libraries needing other, probably redundant little libraries, and yo…

Some of this things you mention are true, but: > makes security auditing more difficult What? If you go all the way, you just review all dependencies too. And if they have a good API, it's actually much easier. For example if your only source of filesystem access is libfilesystem, you can quickly list all modules which have any permanent local state. Splitting huge libraries into well designed categories would make a…

[deleted]

Re: I've Just Liberated My Modules

#544

Post by jonathankoren »

viraptor wrote: post #430
Sanddancer wrote: post #196

Earlier quoted context omitted.

Because a lot of little libraries makes namespaces more complicated, makes security auditing more difficult, makes troubleshooting more difficult as you have to start digging through compatibility of a ton more libraries, makes loading slower, because you have to fopen() a ton more files and parse their contents, etc. Add on top of that those little libraries needing other, probably redundant little libraries, and yo…

Some of this things you mention are true, but: > makes security auditing more difficult What? If you go all the way, you just review all dependencies too. And if they have a good API, it's actually much easier. For example if your only source of filesystem access is libfilesystem, you can quickly list all modules which have any permanent local state. Splitting huge libraries into well designed categories would make a…

Yeah but that's not the world of NPM. It's a clusterfuck of a maze of near duplicate dependencies with no hierarchy or anything. There's no organization or thought. It's just a bunch of crap tossed together to encourage cargo cults programming.

Re: I've Just Liberated My Modules

#545

Post by sjclemmy »

I am a heavily invested user of JavaScript and the surrounding ecosystem and the security aspects of the npm package system has been in the back of my mind for a while. As I don't consider myself an 'expert' in all things npm and package management I've deferred to the general consensus, which didn't seem to mind too much about the security problems npm exhibits (This reminds me of the sub-prime crisis).

I think an event like this is a really positive thing, as it promotes discussion about something that is exceedingly important. All it takes to exploit this vulnerability is a bit of time and effort, it looks really easy to inject malicious code into any number of 'de-published' packages. I hope that some kind of name spacing and / or locking of npm packages results from this and that the javascript ecosystem continues to mature and develop in the right direction. Npm inc have an opportunity here to do the right thing. If they don't then there's going to be a mutiny and a 'better' alternative will supersede npm. Bower anyone? ;)

Re: I've Just Liberated My Modules

#546

Post by alessioalex »

fiatjaf wrote: post #288

Why isn't GitHub the source of all node packages? npm supports it very nicely. I mean: why don't people write `npm install user/repo --save` instead of `npm install package --save` every time already?

In addition to what other people have said, the exact same thing could have happened even if the project was only hosted on Github. Github could receive a DMCA notice, take down the repo and buf.. gone.

Re: I've Just Liberated My Modules

#547

Post by [deleted] »

_nfin wrote: post #130
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".

[deleted]

Re: I've Just Liberated My Modules

#548

Post by kilotaras »

ubernostrum wrote: post #423
indiv0 wrote: post #397

Earlier quoted context omitted.

How about a blockchain-based NPM? Can't take all the computers down. Legal, shmegal.

You can still be jailed for contempt of the order, though. "I've found a clever workaround for court orders" doesn't work around that bit.

Would that work if you did it before the court order?

Re: I've Just Liberated My Modules

#549

Post by namelos »

callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

could we just move our javascript package manager to an organisation rather than a commercial company?

then please use named scope as default like@cycle/core @reactivex/rxjs.

Re: I've Just Liberated My Modules

#550

Post by akie »

ars wrote: post #472
Klathmon wrote: post #257

Earlier quoted context omitted.

Feel free to show a smaller implementation that's more efficient. I've seen several "one liners" in this thread already, and most of them either blow up when something that's not a string is passed in (regardless of how you view strict typing, js doesn't have it and this shouldn't happen), or are extremely slow comparatively (most of them creating and destroying an array every time they are called). Plus this has 100…

> Feel free to show a smaller implementation that's more efficient. How's this: function leftpad (str, len, ch) { ch = (len -= str.length) 0) ch += ch[0]; return ch + String(str); } No local variables, less manipulation of the input string, the string grows at the tail which is more efficient, and the code is much shorter. (With a bit of work you can use the longer ch string that is built to reduce the number of stri…

No offense, but that code is much more difficult to understand. If your goal is to minimize the amount of lines, then you succeeded. If the goal is to produce both correct and readable code, then there's room for improvement.
Post reply on HN