801–810 of 827 posts
Earlier quoted context omitted.
Or something like http://ipfs.io/
IFPS is cool, however pretty far away from being usable as a package management system... Some package management system could use it as a backend, though.
http://ipfs.io/ipfs/QmTkzDwWqPbnAh5YiV5VwcTLnGdwSNsNTn2aDxdX...
Earlier quoted context omitted.
How do you know that you, as a lone developer, aren't writing insecure, unperformant, buggy code?
That's a fair point. But what would concern me, as a lone developer, is liability if you get hacked due to a known vulnerability in an npm module. If the company is looking for a head to roll and someone points out it was a known and resolved issue in later versions that could be a problem for me. Does npm let you tag releases as security fixes? That would make automation to discover it possible.
Earlier quoted context omitted.
It's not about whether the removal is logistically possible, it's about whether a court can punish someone for failing to carry out the removal. Even when the former is actually impossible, a court could still punish for the latter. "Ha ha ha I use technology to cleverly show how futile your orders are" is not the kind of thing you want to say to a court with broad contempt powers.
The court can't punish you for not being able to do the impossible. That's ludicrous. "We have shut down all of our servers, yes. We can't stop people from downloading this, no"
The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…
I'm left thinking of how Go does it, whereby repositories are downloaded via git or whatever version control software's URL. Making it impossible for the admins of "NPM" to take down a package. Add in IPFS and you've got one heck of a "package manager" I guess Go's approach is not really a "package manager" but nobody can truly stop you from downloading from a git repository, and if they do, you can go to the forks e…
Earlier quoted context omitted.
Are you serious? Nice enough to yank it without giving anyone advanced warning, (likely) knowing that it would break numerous projects? My guess based on the timing of his article and his petty argument with kik, is that he intended to cause this commotion to draw attention to his complaint against kik. He could have give the community warning so that major projects could have switched over to another package. So no,…
I had the same interpretation. "I'm gonna take my ball and go home"
Earlier quoted context omitted.
No, he's just careful and professional. Pulling packages from npm on every build in relying on it seems like fine for a little startup that no one would actually care if it went down for a day or two. That's fine. But there are plenty of applications where it would be a catastrophic fuck up to break things because someone somewhere decided to delete something.
This is some sort of joke right? 99% of developers will use npm directly, anyone claiming otherwise and also claiming that everyone else doesn't have a QA department because they do this is completely OOT and from a different decade. This thread has massive upvotes and a mass of comments precisely because this is what everyone does. It's utterly ridiculous to claim otherwise.
Earlier quoted context omitted.
The court can't punish you for not being able to do the impossible. That's ludicrous. "We have shut down all of our servers, yes. We can't stop people from downloading this, no"
Pay damages, then.
The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…
That's what I'm assuming right now anyway. I'm not going to upgrade any Node.js dependencies or run `npm update` or tell anyone to run `npm install`.
If you look at the list of liberated libraries ( https://gist.githubusercontent.com/azer/db27417ee84b5f34a6ea... ) — it's "impossible" for me to know which ones of all these libs I use indirectly via some other libraries, and ...
...Elsewhere in this discussion: (https://news.ycombinator.com/item?id=11343297)
> > Is there a plan to address this?
> Too late. Every package name on the list has been claimed already by a randomer with unknnown intentions.
Sounds dangerous to me. ... And I wish there was some way to get notified, when this issue has been fixed somehow.