Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

571–580 of 827 posts

Re: I've Just Liberated My Modules

#571

Post by tehwalrus »

cballard wrote: post #63
larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

> Developers: less dependencies is better, especially when they're so simple! No! The opposite of that. Lots of little µframeworks, defining composable and generic types, is much better than a giant monolith. The Swift Package Manager is taking this approach, and I think it's great: https://github.com/apple/swift-package-manager#modules The caret character doesn't appear anywhere in the semver spec, so whatever that…

This dichotomy is silly. You should write as little code as possible to do the job required, and should use only the dependencies required. This might be none, or nearly everything, depending on what your app or library is supposed to do.

Re: I've Just Liberated My Modules

#572

Post by Maarten88 »

dham wrote: post #261
swang wrote: post #89

Earlier quoted context omitted.

yes, let's blow up the entire concept that's worked fine for the ~5 years of node's existence because one dude did something extreme.

Woah woah. Hold on there. Lets not throw around strong words like "worked", "concept", "entire", "fine", "did" when discussing NPM.

This. I'm on Windows. Npm never worked for me, like not at all. Npm has cost me lots of wasted time, I know I should be thankful for this free product, but, but, Grrrrr...

Re: I've Just Liberated My Modules

#573

Post by Natanael_L »

tragic wrote: post #554
r0muald wrote: post #444

Earlier quoted context omitted.

The same can happen with GitHub repositories, though, that is how the vast majority of Go packages get published. It's almost as if privately controlled, centralized archives are a bad idea.

1. However, it would deal with GP's problem - that is, that somebody else could upload a package with the same name as one of the ones removed and cause ... surprises the next time someone runs npm install. Github repos are namespaced to their owners, at least, radically reducing the potential for this kind of thing. 2. /s/github/whatever . As long as there's a public URL from which something can be cloned, the idea…

IPFS with public keys per developer and signing of packages would solve that.

Re: I've Just Liberated My Modules

#574

Post by appleflaxen »

drewgross wrote: post #308
echelon wrote: post #279

Earlier quoted context omitted.

I honestly wouldn't have a problem with them removing that option, and only allowing packages to be removed by contacting support with a good reason. (Accidental private info disclosure, copyright violation, severe security bug, etc.) Even Rust's Cargo won't allow you to revoke secrets [1]. I think this is the correct policy. [1] http://doc.crates.io/crates-io.html#cargo-yank

Aside from secrets there is also sensitive data. If someone accidentally uploads some personal information, they need a way to remove it if, say, they receive a court order ordering them to remove it.

If they receive a court order, and there is no technical way to do that, then the court is out of luck. "A court might order it in the future" is not a design constraint on your decisions today.

Re: I've Just Liberated My Modules

#575

Post by gedrap »

mattmanser wrote: post #535
jimjimjim wrote: post #524

Earlier quoted context omitted.

fair enough, but i'm still shaking my head. these places can't have QA departments.

When are you from, 2005? It's been like this so long now even MS use this model with nuget. You sound seriously out of touch.

No, he's just careful and professional.

Pulling packages from npm on every build in relying on it seems like fine for a little startup that no one would actually care if it went down for a day or two. That's fine.

But there are plenty of applications where it would be a catastrophic fuck up to break things because someone somewhere decided to delete something.

Re: I've Just Liberated My Modules

#576

Post by ngrilly »

tragic wrote: post #554
r0muald wrote: post #444

Earlier quoted context omitted.

The same can happen with GitHub repositories, though, that is how the vast majority of Go packages get published. It's almost as if privately controlled, centralized archives are a bad idea.

1. However, it would deal with GP's problem - that is, that somebody else could upload a package with the same name as one of the ones removed and cause ... surprises the next time someone runs npm install. Github repos are namespaced to their owners, at least, radically reducing the potential for this kind of thing. 2. /s/github/whatever . As long as there's a public URL from which something can be cloned, the idea…

About your third point, discoverability and optimization of dependency resolution can be solved by a proxy, in a decentralized system, like the one used in Go.

Re: I've Just Liberated My Modules

#577

Post by gedrap »

Thanks to this, I hope people will consider the way too common deployment approach when during the build time you pull stuff from npm (or whatever external package manager/repository), and if it fails, the build fails.

This is fine for small projects. There are tons of applications where availability is less important then development speed.

However, not being aware of the risks and tradeoffs you're making is just plain simple insanity.

Re: I've Just Liberated My Modules

#578

Post by ngrilly »

throweway wrote: post #272
jonahx wrote: post #106

Earlier quoted context omitted.

This seems like a serious security risk. Is there any solution? Would using version numbers without the caret work?

Signing using private key?

There is no need to sign. Just keep a cryptographic hash (SHA256 is a good bet) of the package in the dependencies manifest, and check it after download.

Using a git repository gives you that for free.

Re: I've Just Liberated My Modules

#579

Post by mike_hearn »

lmm wrote: post #568
raesene4 wrote: post #528

Earlier quoted context omitted.

Most of the programming language Package managers that I've seen either don't have the facility or it's not widely used.

Maven central requires GPG signatures for every package, so all major libraries on the JVM have GPG signatures. (Whether anyone's checking them is another question, but at least you can if you want to)

I really doubt anyone checks them. It's not integrated or enabled by default, there's no way to pin keys in the build files, etc. GPG isn't the solution to such problems, unfortunately.

In one of my old projects (bitcoinj) we did write a Maven plugin that let you put the hashes of the dependencies into your build file.

However it's rare to see Maven/Gradle builds that accept version ranges. And once downloaded it's cached.

Re: I've Just Liberated My Modules

#580

Post by belorn »

imtringued wrote: post #493
marcuskaz wrote: post #311

Earlier quoted context omitted.

v0.0.3 is open source, though there is no license in the Github repo, so murky, but NPM says its WTFPL Since old code is under a very permissive license, then the new owner could create v0.0.4 add code and make the new version closed with a restrictive license. This is where a license like GPL would benefit overall, since all future code requires to be under the same license. Either way, it seems like a dangerous pol…

Now I'm seriously wondering if npm is a goldmine for GPL infringement. If someone has an insane dependency tree with 1000 entries then there is bound to be at least some GPL in there forcing everything else to be GPL too.

With 1000 of dependencies, I would be much more worried that one of them are proprietary licensed (or was ripped from a place with no copyright license attached and then had a new license added the original authors permission). Imagine distributing a "$100 per use" software for a few years without paying, and how the court system would react.

I guess this is why debian takes licenses so serious.

Post reply on HN