Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Left-pad as a service

left-pad.io

Post reply on HN
Print view View original

91–100 of 269 posts

Re: Left-pad as a service

#91

Post by beeker87 »

andy_ppp wrote: post #8

Hahaha - isn't it hysterical how everyone using npm for small reusable code pieces! Aren't they morons! How stupid of people to trust their package manager to be consistent and correct and return packages they were expecting. How stupid of people to reuse small often used functions that only do one thing well. How does everyone taking the piss intend to protect themselves from this in their OS package manager, or PPM…

Wouldn't it be a lot easier and more secure if you simply looked up the code in these packages you're using, reviewed the code to make sure it's legitimate, then copied it to say, your own utils.js package? I'm not even talking about the left-pad package, which shouldn't even be part of the discussion... If you're worried about including 2-4 lines of code on your own then you shouldn't be making an application other people will use in the first place.

Apparently it's not obvious that having a ton of dependencies on 3rd party packages, of which can change at any time on the whim of the owner, is pretty insane in terms of security and minimizing complexity of your application.

You do realize that even though you reviewed the 20 different packages you use at one time, they can change at any time?

I would love to hear what a senior dev at any reputable, long established technology company thinks about including tens, if not hundreds (and some apps, thousands?) of 3rd party packages from strangers on the internet with no validity checks in place. Sign me up!

Re: Left-pad as a service

#93

Post by mreiland »

smt88 wrote: post #54
creshal wrote: post #35

Earlier quoted context omitted.

Even the Java ecosystem managed to get their crap together and make the excellent Apache Commons library collection to deal with a similar situation (anaemic to useless standard library). C++ has STL and Boost. Only the PHP and JS communities seem to think that not having a solidly designed "base" library is fine (and even PHP seems to be getting better at it with 7).

PHP is absolutely the last language I thought anyone would accuse of missing standard features. PHP is massive and includes absolutely insane numbers of functions to do everything. If you can think of 3 basic, universal functions that PHP doesn't include, I'd be shocked. Also, PHP 7 has absolutely nothing to do with standard libraries, as it doesn't really add anything in that regard.

the cool kids make fun of PHP.

You must not be a cool kid.

Re: Left-pad as a service

#94

Post by [deleted] »

smt88 wrote: post #54
creshal wrote: post #35

Earlier quoted context omitted.

Even the Java ecosystem managed to get their crap together and make the excellent Apache Commons library collection to deal with a similar situation (anaemic to useless standard library). C++ has STL and Boost. Only the PHP and JS communities seem to think that not having a solidly designed "base" library is fine (and even PHP seems to be getting better at it with 7).

PHP is absolutely the last language I thought anyone would accuse of missing standard features. PHP is massive and includes absolutely insane numbers of functions to do everything. If you can think of 3 basic, universal functions that PHP doesn't include, I'd be shocked. Also, PHP 7 has absolutely nothing to do with standard libraries, as it doesn't really add anything in that regard.

[deleted]

Re: Left-pad as a service

#95

Post by [deleted] »

smt88 wrote: post #54
creshal wrote: post #35

Earlier quoted context omitted.

Even the Java ecosystem managed to get their crap together and make the excellent Apache Commons library collection to deal with a similar situation (anaemic to useless standard library). C++ has STL and Boost. Only the PHP and JS communities seem to think that not having a solidly designed "base" library is fine (and even PHP seems to be getting better at it with 7).

PHP is absolutely the last language I thought anyone would accuse of missing standard features. PHP is massive and includes absolutely insane numbers of functions to do everything. If you can think of 3 basic, universal functions that PHP doesn't include, I'd be shocked. Also, PHP 7 has absolutely nothing to do with standard libraries, as it doesn't really add anything in that regard.

[deleted]

Re: Left-pad as a service

#97

Post by faizshah »

naasking wrote: post #61
faizshah wrote: post #24

I don't understand why this community has to have a weekly cycle of bashing different programming communities. Every week there's a new drama thread bashing Java devs, Go devs, Javascript devs etc. The thing that I come to this community for every week is to read about new developments in our industry, if you don't come here for that then what are you coming here for? And wasn't it just a few months ago people were p…

> I don't understand why this community has to have a weekly cycle of bashing different programming communities. It's funny if done in good taste. You should be able to take a joke with good humour, even if it's at your own expense, and this is a pretty good joke.

My comment wasn't directed at the OP it was directed at the community and these weekly community bashing cycles.

Re: Left-pad as a service

#98

Post by icebraining »

efaref wrote: post #90
naasking wrote: post #81

Earlier quoted context omitted.

Except a good package manager will let you specify exactly which version you wish to depend upon, so any changes you make upstream will have no effect on people who protect themselves against automatic version updates. Seriously, the properties of good package management should be obvious by now. Any design that can break dependents and there's nothing they can do to protect themselves is broken.

That's just a no-true-scotsman fallacy. And pinning versions just means you lose automatic updates, which is surely the point of using a package manager in the first place. Otherwise you might as well just download the package and include it verbatim.

No, it's not an NTS fallacy. And the package manager is mostly useful for tracking updates and simplify the process; having it automatically update is completely optional, and personally, I never do.

Re: Left-pad as a service

#100

Post by rdancer »

afandian wrote: post #17
andy_ppp wrote: post #8

Hahaha - isn't it hysterical how everyone using npm for small reusable code pieces! Aren't they morons! How stupid of people to trust their package manager to be consistent and correct and return packages they were expecting. How stupid of people to reuse small often used functions that only do one thing well. How does everyone taking the piss intend to protect themselves from this in their OS package manager, or PPM…

I think it's less smugness (there certainly is some) and more disbelief / unfamiliarity. JS isn't the first language without great libraries (C's stdlib, `math.h`, `string.h` are good but don't have string padding functions, for example) so there's precedence going back a very long way. Most solutions involve coming up with a utilities library that contains the basic things (like a math library, or a strings library)…

> C's stdlib, `math.h`, `string.h` are good but don't have string padding functions

Of course they do; how would you align printouts otherwise?

    $ cat main.c
    #include 
    
    int main()
    {
      (void) printf ("%42s\n", "hello");  // right-align, 42 chars
      (void) printf ("%-42s\n", "hello"); // left-align
    }
    $ gcc main.c
    $ ./a.out | cat -A                                                                                                                                                 
                                        hello$
    hello                                    $
    $ ./a.out | wc -L
    42
Post reply on HN