Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

691–700 of 827 posts

Re: I've Just Liberated My Modules

#691

Post by krakensden »

nirvdrum wrote: post #399
sbuttgereit wrote: post #245

I've been reading in the comments regarding 1) the practical effect of breaking builds and 2) the security issues of how package names can be reused on npm once they are unpublished (versioning aside for a moment). I wonder what other, similar, packaging distribution platforms are vulnerable to this sort of thing? I am not speaking from knowledge of any of the procedures of any of those I'm about to mention, but I ha…

I've had deploys break because gems were removed from RubyGems.org. Using CI as a gate isn't sufficient because a gem can be removed in the window between a completed CI run and the deploy. Making it harder, generally if you have a gem installed locally you won't notice the problem until you need to install it on a fresh system. It used to be the case that a yanked gem was simply removed from the gem index, but the f…

Dear Everyone Doing Devops: do not build gems on your production servers. Build a tarball, test the tarball through dev/staging, deploy the tarball to production.

For any value of tarball- literal tarball, deb/rpm (actually CPIO under the hood, but who cares), prebaked AMI (not tar at all), docker image (tarball of JSON + nested tarballs. Seriously, it's tar all the way down).

Everything will be better. Roll forwards. Roll backs. Speed. Attack surface. Reliance on 3rd party services that will rate limit you hard.

Re: I've Just Liberated My Modules

#692

Post by kefka »

patio11 wrote: post #385
Joky wrote: post #350

Earlier quoted context omitted.

I'm not sure how the court could force you to do something you can't possibly do...

"So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct." "You're being honest with me." "Yes, your Honor." "Will the computers continue harming the plaintiff's interests if shut off?" "... That would be dreadfully inconvenient, your Honor." "Do you have a more convenient solution?" "No, your Honor." "You are hereby ordered to turn off your computers…

That's why I'm looking into IPFS(https://ipfs.io) as part of my infrastructure. How that would look then, with IPFS...

> "So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct."

> "You're being honest with me." "Yes, your Honor."

> "Will the computers continue harming the plaintiff's interests if shut off?" "No it wouldn't, your Honor.".....

And suddenly things like NPM can transfer the data to other machines, and those machines themselves can also provide to others. Deletions are impossible if people still want the content.

And IPFS guarantees that if a single node has the data, then any node can download it and also be part of the cloud that provides the data. Once it's out, it's impossible to retract.

Re: I've Just Liberated My Modules

#693

Post by NoGravitas »

repomies691 wrote: post #510
mdpopescu wrote: post #431

Earlier quoted context omitted.

Or something like http://ipfs.io/

IFPS is cool, however pretty far away from being usable as a package management system... Some package management system could use it as a backend, though.

In fact, gx[0] is such a package management system.

[0]: https://github.com/whyrusleeping/gx

Re: I've Just Liberated My Modules

#694

Post by jplur »

viraptor wrote: post #421
smaddox wrote: post #200

Earlier quoted context omitted.

I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provides distributed hosting, it's even easier.

As much as I agree, IPFS is still very much under construction and I don't think any known package managers got started after IPFS was reliable. You can experiment with ipfs-backed git remotes though. That's already possible.

Yes the IPFS implementation might change but not the content multihash addressing. Linking to data with those addresses is the generic 'package management' that solves all these problems (references to mutable data at mutable origins, circular dependencies, data caching, namespace conflicts). The specifics of resolving links will hopefully be something we don't think about much.

I've played around with ipfs.js for resolving links into eval'd js at runtime and imagine a npm replacement would be pretty trivial. The IPFS peer to peer swarm seems stable to me but you could also dump all your hash-named files into a s3 bucket or something as a fallback repo.

Re: I've Just Liberated My Modules

#695

Post by scrabble »

akie wrote: post #550
ars wrote: post #472

Earlier quoted context omitted.

> Feel free to show a smaller implementation that's more efficient. How's this: function leftpad (str, len, ch) { ch = (len -= str.length) 0) ch += ch[0]; return ch + String(str); } No local variables, less manipulation of the input string, the string grows at the tail which is more efficient, and the code is much shorter. (With a bit of work you can use the longer ch string that is built to reduce the number of stri…

No offense, but that code is much more difficult to understand. If your goal is to minimize the amount of lines, then you succeeded. If the goal is to produce both correct and readable code, then there's room for improvement.

If you are talking about a module that everyone just includes and expects to work, then I'd imagine the goal would be a combination of correct and efficient, not readable.

Re: I've Just Liberated My Modules

#696

Post by larrik »

gariany wrote: post #80
x0ner wrote: post #17

Not sure I follow this completely... You start a project with the same name as a company, which owns the registered brand and are surprised when some 3rd party complies with legal suggestions to make an adjustment? Seems kind of silly to expect that NPM would want to fight for your project name when you didn't seem to do your own due diligence when picking a name. Also, a bit backwards to go remove all your modules a…

a) from what I understand, his project was there first. b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better. c) the guy wrote: "NPM is no longer a place that I’…

His project is only 6 months old, it seems? Kik has been around for years (I used it a long time ago, before iMessage was a thing).

Re: I've Just Liberated My Modules

#697

Post by untog »

Grue3 wrote: post #494
stevebmark wrote: post #453

Earlier quoted context omitted.

Javascript has an almost non-existent standard lib. Obviously Python ships with most of the kitchen sink in core. You're not grumpy, but you're misguided.

Why not create one big package that's a lib? Call it "batteries". In fact, it already exists: Jquery.

> In fact, it already exists: Jquery.

Not these days. A lot of JS is written server-side. I'd say the likes of Underscore/Lodash are closer to being a JS "stdlib".

Re: I've Just Liberated My Modules

#698

Post by overgard »

cyphar wrote: post #422
overgard wrote: post #401

Earlier quoted context omitted.

only in the most narrow sense. His cause, whatever it is, isn't furthered, but now everyone involved (including him) looks bad, and a lot of innocent people have had their time wasted fixing something that shouldn't have broken. It's a loss for everyone involved. He looks petty and untrustworthy, npm looks amateurish, kik gets bad publicity, and everyone using this junk is stuck with their face in their palms.

Don't blame the guy who pressed a button that allows you to unpublish a core module. Sure, it was done on purpose this time , but what if it happened by accident. Your "package manager" shouldn't be this fragile.

I can blame both of them.

Re: I've Just Liberated My Modules

#699

Post by larrik »

I don't think Kik is the bad guy here. This npm module was rather new (I personally think him not knowing Kik existed was odd, and not googling the name at all even odder. Even still, I think Kik's response and npm's response were perfectly valid.

Looking at the voting of the comments here makes me sad for what has become of the HN community.

Re: I've Just Liberated My Modules

#700

Post by grincho »

ngrilly wrote: post #578
throweway wrote: post #272

Earlier quoted context omitted.

Signing using private key?

There is no need to sign. Just keep a cryptographic hash (SHA256 is a good bet) of the package in the dependencies manifest, and check it after download. Using a git repository gives you that for free.

SHA1 collisions are affordable for large actors now and getting cheaper all the time, so git, with its SHA1 assumptions hard-coded, unfortunately doesn't protect you anymore. But the local hash approach is a good one, proven in pip 8 (Python) and npm-lockdown (JS).
Post reply on HN