Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Left-pad as a service

left-pad.io

Post reply on HN
Print view View original

151–160 of 269 posts

Re: Left-pad as a service

#151

Post by coryfklein »

faizshah wrote: post #97
naasking wrote: post #61

Earlier quoted context omitted.

> I don't understand why this community has to have a weekly cycle of bashing different programming communities. It's funny if done in good taste. You should be able to take a joke with good humour, even if it's at your own expense, and this is a pretty good joke.

My comment wasn't directed at the OP it was directed at the community and these weekly community bashing cycles.

If you want to actually know the "why", I don't think any one person can answer for certain but I have noticed similar trends on HN and attribute it to the culture necessary among start-ups: brutally challenging assumptions and discovering failure points.

I think that kind a culture is necessary in quickly shutting down projects that have a high likelihood of failure before too much time is invested in them. Unfortunately, that culture also tends to leak into many other aspects of the community.

Re: Left-pad as a service

#152

Post by Alupis »

pdkl95 wrote: post #47
andy_ppp wrote: post #8

Hahaha - isn't it hysterical how everyone using npm for small reusable code pieces! Aren't they morons! How stupid of people to trust their package manager to be consistent and correct and return packages they were expecting. How stupid of people to reuse small often used functions that only do one thing well. How does everyone taking the piss intend to protect themselves from this in their OS package manager, or PPM…

> How stupid of people to reuse small often used functions that only do one thing well. This is a straw man argument. The reason so many people are criticizing left-pad et al is about the cost of adding a dependency. > trust their package manager That's exactly the problem: you're assuming that a package manager can be trusted. The network isn't reliable, packages can changed innocently or maliciously, and mistakes h…

Not to mention, their package manager is governed by a single for-profit company, that could disappear at any time, taking the entire infrastructure with it (breaking everything...)

There's a lot of talk of decentralizing npm - but come on folks, what motivation would npm the company have to do that? It's the same issue as with GitHub (only that, with GitHub at least, if you're using git properly, GitHub disappearing tomorrow should have little impact).

Re: Left-pad as a service

#153

Post by Cthulhu_ »

Alupis wrote: post #152
pdkl95 wrote: post #47

Earlier quoted context omitted.

> How stupid of people to reuse small often used functions that only do one thing well. This is a straw man argument. The reason so many people are criticizing left-pad et al is about the cost of adding a dependency. > trust their package manager That's exactly the problem: you're assuming that a package manager can be trusted. The network isn't reliable, packages can changed innocently or maliciously, and mistakes h…

Not to mention, their package manager is governed by a single for-profit company, that could disappear at any time, taking the entire infrastructure with it (breaking everything ...) There's a lot of talk of decentralizing npm - but come on folks, what motivation would npm the company have to do that? It's the same issue as with GitHub (only that, with GitHub at least, if you're using git properly, GitHub disappearin…

What motivation does Sonatype have for sponsoring Maven? What motivation do dozens of web hosters have with providing a free mirror for Debian or Ubuntu packages? As far as I know, NPM is not a profitable endeavour, so making it distributed would decrease costs, and the company behind it can focus on consultancy or whatever it is they do.

Re: Left-pad as a service

#154

Post by smhg »

andy_ppp wrote: post #8

Hahaha - isn't it hysterical how everyone using npm for small reusable code pieces! Aren't they morons! How stupid of people to trust their package manager to be consistent and correct and return packages they were expecting. How stupid of people to reuse small often used functions that only do one thing well. How does everyone taking the piss intend to protect themselves from this in their OS package manager, or PPM…

Yes, it's a smug joke, but I think it's a funny joke nonetheless (if you got the context). Don't take it too serious.

So many good things happen in the JavaScript ecosystem. Nothing is perfect. This kind of criticism can help. Even if it's a bit much these days/hours ;)

I can't imagine npm and many others won't learn something from this. What more can you ask for?

Re: Left-pad as a service

#155

Post by takno »

pfooti wrote: post #125
deong wrote: post #72

Earlier quoted context omitted.

"Zero" isn't a cost of anything -- there's no free lunch. NPM, like any package manager, pretty much blindly accepts user input. I, as a module maintainer, could happily change every single function in my modules to function whatever() { return "WHHEEEEEEE!!!"; } and check it in. Doing that will result in no fewer problems than just deleting the module entirely, and it's not NPM or any other similar package manager's…

If you do that, won't you have to increment your version number? Because with npm, except for left-pad due to oddities of the npm-specific ^ semver operator, you always have to increment your version and you can always pin earlier versions. That said, the ^ sevmer operator would probably upgrade to your sabotaged version if you went from 1.2.3 to 1.2.4, and people would have to figure out what the other operators mea…

Node has a history of kicking out a new release virtually every week, often with crazy breaking changes. Quite sensibly the Debian packagers decided not to try to keep up with that game. There is an easy-to-add on repo if you really want it, although Typescript works just fine in the packaged version so I haven't.

Not sure what your point is on postgres, since 9.4 is right there in the repo.

Re: Left-pad as a service

#156

Post by [deleted] »

beeker87 wrote: post #91
andy_ppp wrote: post #8

Hahaha - isn't it hysterical how everyone using npm for small reusable code pieces! Aren't they morons! How stupid of people to trust their package manager to be consistent and correct and return packages they were expecting. How stupid of people to reuse small often used functions that only do one thing well. How does everyone taking the piss intend to protect themselves from this in their OS package manager, or PPM…

Wouldn't it be a lot easier and more secure if you simply looked up the code in these packages you're using, reviewed the code to make sure it's legitimate, then copied it to say, your own utils.js package? I'm not even talking about the left-pad package, which shouldn't even be part of the discussion... If you're worried about including 2-4 lines of code on your own then you shouldn't be making an application other…

[deleted]

Re: Left-pad as a service

#157

Post by smt88 »

mreiland wrote: post #93
smt88 wrote: post #54

Earlier quoted context omitted.

PHP is absolutely the last language I thought anyone would accuse of missing standard features. PHP is massive and includes absolutely insane numbers of functions to do everything. If you can think of 3 basic, universal functions that PHP doesn't include, I'd be shocked. Also, PHP 7 has absolutely nothing to do with standard libraries, as it doesn't really add anything in that regard.

the cool kids make fun of PHP. You must not be a cool kid.

I never said I like PHP. I use it daily for work and hate it. I was just refuting something on a factual basis -- PHP's "standard library" is absolutely enormous.

Re: Left-pad as a service

#158

Post by rspeer »

naasking wrote: post #75
Manishearth wrote: post #71

Earlier quoted context omitted.

> The cost of a dependency for a good package manager is zero The recent left_pad fracas has proved that that is not the case. Snapshot dependencies in-tree? Sure. But a package manager based dependency will be predicated on trusting a lot of things.

I said a good package manager. The fact that the npm package database is fully mutable is a huge problem.

It's not fully mutable. You can't change the code of a particular version, for example. The particular problem with left-pad was that npm is mutable in one way: deleting packages.

Re: Left-pad as a service

#159

Post by TickleSteve »

pfooti wrote: post #126
TickleSteve wrote: post #38

Earlier quoted context omitted.

its called self-regulation. Each community has its own quirks and extremes as seen by everyone else. Without the bashing, they would become even more extreme. At least after this a lot of devs will think twice about making "micro-modules".

I'm pretty sure that attitude is called "paternalism". Self-regulation works better when it's self-directed, as opposed to other-directed (as in, someone else doing the regulation). `I shouldn't do ${foo} because people will make fun of me` is a horrible attitude to foist on anyone else, and anyone who tries to propagate that attitude isn't helping the community at all.

'self' here is the wider HN community... hence the 'self' regulation.

Re: Left-pad as a service

#160

Post by swasheck »

beeboop wrote: post #76

Tomorrow: left-pad.io announces $120 million investment at $1.2 billion valuation Month from now: left-pad announces purchase of $170 million office building in SV to house their 1200 employees

Eighteen months from now: left-pad announces massive reduction in workforce. 1150 laid off.
Post reply on HN