Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

581–590 of 827 posts

Re: I've Just Liberated My Modules

#581

Post by slang800 »

brazzledazzle wrote: post #489
sorenjan wrote: post #346

Earlier quoted context omitted.

I've never used npm, but doesn't it take at least as long to find, evaluate, and install a package like left-pad as it would to just write the function yourself when you find you need it?

Would simply copying something into your project as small as 17 lines make for a good compromise?

No - then you won't get updates easily and everyone reading your project would have to make sure that your copy of the module hasn't diverged from the original module before working with it, especially if it's a larger module that has full documentation and a community of people who know how to work on it.

Re: I've Just Liberated My Modules

#583

Post by furyferret »

Klathmon wrote: post #61
larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

Personally i'm going to use an installable module for something even that small, because i can, and it works. The benefits from an install registry don't go away just because the module is very tiny... Why would i spend my time re-inventing the wheel for every little thing i do? And if i'm not reinventing, then i'd be copy/pasting which is much worse. At best that's a waste of time and effort to properly document the…

Re-inventing the wheel in 17 lines of code is called programming.

Re: I've Just Liberated My Modules

#584

Post by Loque »

overgard wrote: post #321
praxulus wrote: post #15

This is a surprisingly effective protest action. It got the attention of an incredible number of people very quickly, and the damage is mostly limited to wasting the time of a bunch of build cops. I don't have much of an opinion on his actual reasons for protesting, but I do think it was a pretty cool protest.

The "attention" he's going to get is people annoyed at him for breaking their shit carelessly over a petty dispute with a third party. I have some stuff at work that uses NPM, and I don't know if he broke it, but my thoughts right now are "fuck that guy" and "I would never use NPM again if I knew how catastrophically badly designed it is" and more broadly "if the JS community is this amateur and petty I'm writing my…

See you in enterprise :`D

Re: I've Just Liberated My Modules

#585

Post by lmm »

BinaryIdiot wrote: post #318
bentlegen wrote: post #58

Earlier quoted context omitted.

Unless you're npm: https://twitter.com/seldo/status/712414400808755200

That's pretty interesting. I wonder if it's within npm's legal right to distribute someone else's IP in such a way that they do not desire. Granted the license is WTFPL but does that include taking over the IP itself?

> Granted the license is WTFPL but does that include taking over the IP itself?

In some jurisdictions you have "moral rights" in addition to your copyright - but even in those, I'd expect the WTFPL constitutes a license to falsely claim authorship of the covered code. I mean, the text pretty clearly authorizes you to do so on its face, and courts lean pretty strongly towards reading words under their plain, normal meanings. IANAL.

Re: I've Just Liberated My Modules

#586

Post by tangus »

iopq wrote: post #525
ubernostrum wrote: post #478

Earlier quoted context omitted.

It's not about whether the removal is logistically possible, it's about whether a court can punish someone for failing to carry out the removal. Even when the former is actually impossible, a court could still punish for the latter. "Ha ha ha I use technology to cleverly show how futile your orders are" is not the kind of thing you want to say to a court with broad contempt powers.

The court can't punish you for not being able to do the impossible. That's ludicrous. "We have shut down all of our servers, yes. We can't stop people from downloading this, no"

Pay damages, then.

Re: I've Just Liberated My Modules

#587

Post by antihero »

bsder wrote: post #203
tantalor wrote: post #185

Earlier quoted context omitted.

They have the responsibility to defend their trademark, otherwise it could be abused by a rival claiming they did not adequately defend it. That said, NPM could have just said, "No, stop bothering us" and the lawyers might have backed down, satisfied their attempt to defend the trademark fulfilled their duty.

> They have the responsibility to defend their trademark, otherwise it could be abused by a rival claiming they did not adequately defend it. Agreed, but you can do this without pissing off everybody in the universe. http://www.businessinsider.com/jack-daniels-wrote-what-has-t... Before, I had no idea who kik was. Now , I know them as a bunch of jerks. Big fail for a "social media" company.

Yeah but literally nobody is going to care about this outside the programmer community, and we're not their target audience.

Re: I've Just Liberated My Modules

#588

Post by lmm »

heavenlyhash wrote: post #305
camwest wrote: post #250

Earlier quoted context omitted.

People can still just use the older versions that are immutable.

Except this very same string of events makes it quite obvious that versions aren't systematically immutable. And vast numbers of people are suddenly shocked (shocked!) to realize there's no mechanical verification of stuff like this. It can all happen whimsically, and the result isn't just a loss of service, it's service with different results and no verification nor notice .

> Except this very same string of events makes it quite obvious that versions aren't systematically immutable.

From this thread it sounds like: a) npm specifically overrode their normal process to allow him to publish new code at the same version number b) npm did verify that the code he was publishing was the same as the old code at that version number as part of this.

So sounds like immutability of specific versions is systematically enforced by npm?

Re: I've Just Liberated My Modules

#589

Post by lmm »

kzrdude wrote: post #179
camwest wrote: post #96

FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintai…

Obviously not your choice, but it's a problem of using 0.0.x versions; no flexibility for the crate author to push minor updates.

If you want the flexibility of pushing minor updates the flipside is you need to provide a definition of what constitutes minor - at which point you should be on 1.x.

Re: I've Just Liberated My Modules

#590

Post by exDM69 »

callumlocke wrote: post #541
sorenjan wrote: post #346

Earlier quoted context omitted.

I've never used npm, but doesn't it take at least as long to find, evaluate, and install a package like left-pad as it would to just write the function yourself when you find you need it?

No. I could find, evaluate and install that package quicker than I could write the code that carefully. And the second time I need it, it's just "remember, install". Also, keeps my code small and focused.

Do you not read the code of packages you're including in your projects? I usually do at least browse through the "beef" of the code for anything I consider adding as a dependency. And try to figure out what's the level of maintenance I can expect, history of bugs, sometimes try to contact the authors, etc.

In short: it would take me a whole lot more time to evaluate whether or not to depend on something as trivial as leftpad than to write it myself. I'm pretty confident I can do that in a minute or two and I trust my collaborators to not break it.

Post reply on HN