Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

631–640 of 827 posts

Re: I've Just Liberated My Modules

#631

Post by pluma »

st3v3r wrote: post #14

Hopefully NPM will think of this in the future, next time they try something like this.

Let's remember that NPM Inc has also been toying with the idea of banning IPs associated with "bad people" for behaviour outside of NPM itself.

In other words: they think it's morally justifiable to ban a company's IP address(es) from the NPM service because one of their employees said something objectionable on Twitter (not involving NPM or any of its representatives). And what should the company do if their employee gets them banned? Why, fire them of course.

Re: I've Just Liberated My Modules

#633

Post by douche »

Skywing wrote: post #324
douche wrote: post #19

Earlier quoted context omitted.

Seriously, it's a disgrace that Javascript has such piss-poor string handling built into it's standard library that such a thing is necessary.

Coming in ES7!

Which I might be able to use by 2020 or 2025... Enterprises are still dragging along on IE8 and 9.

Re: I've Just Liberated My Modules

#635

Post by mstade »

larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

> Developers: less dependencies is better, especially when they're so simple!

I tend to agree, but this is conflating the issue of having dependencies with delivery.

It's perfectly ok to build small and compose large, with some of the smaller constituents being external dependencies, but the problem here is that the delivery of the packages isn't immutable and static. When you publish a package to npm, you don't publish it along with a copy of all your dependencies (by default, there are mechanisms to do this however.) The external dependencies will be pulled in separately when people install your package. What you're suggesting could still be done with an external dependency, just by making sure you it's only external at development time, but at publish it is truly bundled along with your package. This obviously comes with other costs, like the inability to dedupe packages.

Re: I've Just Liberated My Modules

#636

Post by mstade »

The ability to "unpublish" a package is fundamentally strange, because it enables situations like this.

It's also strange that people put so much trust and faith into a private company to host and distribute packages – largely for free – and then rile against them when they do stuff like this with infrastructure they own. NPM is not some free and open space, it's a private company with private interests. You should expect them to do whatever they need to protect those interests – which may or may not coincide with public interest.

I hope this resolves in more people getting involved with projects like IPFS and Nix, that may ultimately provide some recourse to the issues of centralized package management.

Re: I've Just Liberated My Modules

#637

Post by pluma »

By complying with kik's request, npm has set a precedent for library authors that basically means: in doubt, you will lose your package name, even if you dispute the trademark.

This means npm apparently wants everyone to handle trademark disputes like Jade did: https://github.com/pugjs/pug/issues/2184

Re: I've Just Liberated My Modules

#638

Post by parasite101 »

tarsinge wrote: post #557
smsm42 wrote: post #348

Reading some of the comments reminds me old tale about a young man, that every morning on his way to work passed by a beggar and gave him a coin (that was back when coins actually had some value). One morning though the beggar notices the coin is smaller than usual, and he asks: - Why you gave me a different coin today? and the young man says: - I got married and now I'm starting a family, I need more money so I can…

A more accurate story would be: A young man is giving a piece of wood for free to a beggar. Then one day, when the beggar has constructed a house using the wood, the young man asks it back : - But you gave it to me! - It was for free, so don't dare you to complain If it was given with the (maybe implicit) clause that there was no limit of time, I don't see how the thing being free give you the right to take it back,…

It is instructive what kind of mental contortions people use when they think they deserve something (including continued labor) for free.

Re: I've Just Liberated My Modules

#639

Post by AnkhMorporkian »

perennate wrote: post #299
krapp wrote: post #294

Earlier quoted context omitted.

Which is a nice gesture, but since the wtfpl seems to give up any pretense of ownership on the part of the author, it's also irrelevant. Anyone can do what they want with it. If he wanted to keep tighter control of the code he should have published under a more restrictive license. And, if he wanted people to take the time to be polite and contact him through his github account, maybe he shouldn't have wrecked so man…

The "ownership" I assume is referring to ownership on npm. I was just saying that, based on that excerpt from the blog post, it sounds like the author didn't actually want to keep tighter control of the code, and that re-publishing the code doesn't really go against the author's wishes.

I'm pretty sure the ownership he's referring to is the github repo. Since he unpublished from npm, he has no control over those names.

Re: I've Just Liberated My Modules

#640

Post by GFK_of_xmaspast »

voltagex_ wrote: post #292
akkartik wrote: post #111

Earlier quoted context omitted.

Erm, that's not a very good example. You're pointing out some ancient source file from back when unix had no package management. These days echo.c is part of coreutils, a large package which is economic to manage dependencies for at scale. It's interesting to think about the distinction between promiscuous dependencies (as pioneered by Gemfile) and the Unix way. I like the latter and loathe the former, but maybe I'm…

What on earth is cat doing that it needs 36KLoC (with dependencies)? I'm starting to see where http://suckless.org/philosophy and http://landley.net/aboriginal/ are coming from (watch Rob's talks, they're very opinionated but very enjoyable).

The version of cat.c here: http://www.scs.stanford.edu/histar/src/pkg/cat/cat.c has 255 lines in the source, and brings in these headers:

#include #include #include #include #include #include #include #include #include #include #include

which are needed for things like memory allocation, filesystem access, io, and so on.

One can imagine alternative implementations of cat that are full of #ifdefs to handle all the glorious varieties of unix that have ever been out there.

Post reply on HN