651–660 of 827 posts
Sadly there is a user @nj48, who already published empty modules and took the names [1]. Is this a joke or something coordinated with the community? [1] https://www.npmjs.com/~nj48 EDIT : The hijacked modules look suspicious. http://www.drinchev.com/blog/alert-npm-modules-hijacked/
The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…
I also think dependencies should be non-flat/tree/static. So that you only have to trust one dependency, and not all of it's child dependencies and their dependencies too. You should only need to manage your own dependencies, not other peoples dependencies.
There should also be a way to contact everyone who use your module, so you can tell them about critical bugs etc.
Earlier quoted context omitted.
A more accurate story would be: A young man is giving a piece of wood for free to a beggar. Then one day, when the beggar has constructed a house using the wood, the young man asks it back : - But you gave it to me! - It was for free, so don't dare you to complain If it was given with the (maybe implicit) clause that there was no limit of time, I don't see how the thing being free give you the right to take it back,…
It's more like the young man telling the beggar that he can come cut the wood from his land for free. Then one day the young man stops letting the beggar cut his wood for free. He's not taking back the wood that's already been cut. The problem is if the beggar wasted the wood he did take, and took for granted the assumption that he would always be able to get more. Relying on something continuing to exist on the inte…
this is why your dependencies should be checked into git
I've been doing the exact opposite for a long time now.
Specifically with Nuget packages, because I could just trust that the package would be there.
Considering that node_modules often has something like 4000 files in it, this seems like a huge problem to me. Especially considering the amount of redundancy in node_modules.
Uggh... unfortunately if the trust of the package distribution sites is violated then there's no other choice than to check in dependencies.
:(
I'm not happy about this at all.
Earlier quoted context omitted.
The court can't punish you for not being able to do the impossible. That's ludicrous. "We have shut down all of our servers, yes. We can't stop people from downloading this, no"
Pay damages, then.
Extremely dick move on behalf of the developer. Why would you remove modules that other people are using in production? Did you think a small team like NPM would go head to head with a company having full time lawyers? And for what?
Why is that a dick move? What would you do if npm or github goes down tomorrow? Vendor your dependencies if you want to make sure your own project doesn't break.
Earlier quoted context omitted.
But none of Fileutils, Shellutils and Textutils was ever as tiny as many npm or gem modules. I thought how commands are bundled into packages was the entirety of what we were discussing. That was my interpretation of larkinrichards's comment (way) up above. Packages are the unit of installation, not use. Packages are all we're arguing about. My position: don't put words in God's mouth :) The unix way is commands that…
Underscore/lodash is a great bundle of functions that do simple things well. And it's a tiny enough library that there is really no need to split it into 270 modules. I support packages of utility functions. Distributing them individually is a waste of resources when you have tree shaking. I trust a dependency on lodash. I don't trust a dependency on a single 17 line function.
Earlier quoted context omitted.
Woah woah. Hold on there. Lets not throw around strong words like "worked", "concept", "entire", "fine", "did" when discussing NPM.
This. I'm on Windows. Npm never worked for me, like not at all. Npm has cost me lots of wasted time, I know I should be thankful for this free product, but, but, Grrrrr...
Earlier quoted context omitted.
Would simply copying something into your project as small as 17 lines make for a good compromise?
No - then you won't get updates easily and everyone reading your project would have to make sure that your copy of the module hasn't diverged from the original module before working with it, especially if it's a larger module that has full documentation and a community of people who know how to work on it.
Something about javascript makes people crazy...