SECURITY NIGHTMARE!!!!!!!!!
Without any sort of nonce, this service is trivially susceptible to a replay attack
Left-pad as a service
241–250 of 269 posts
Re: Left-pad as a service
#242If left-pad.io goes down, will it take the rest of the WWW infrastructure with it? I'm missing a Q&A for important and apparently relevant questions like these.
Re: Left-pad as a service
#243I went ahead and made an SDK https://www.npmjs.com/package/left-pad-io-js-sdk
I think you should think ahead and change it to "any-pad" or something similar and offer adapters/plugins. What are users of your library do when some industry-disrupting startup comes in offering left- and mid- pads?
Changing your npm shouldn't be a problem, just unpublish it and create new one.
Also don't forget to check trademark list before creating npm because "they will come knocking on your doors closing all your accounts".
Re: Left-pad as a service
#244I'm desperately looking for some feedback from big users. - Does it scale well? - Is it pragmatic for long term use scenario? - Is it Thread safe? - Does it learn from previous call made to the API? - Does it have a modern access layer? - Does it enforce 2nd factor authentication? - Is it compatible with Docker containers? - What about multi-region scenarios? - Any benchmark available showing usage with AWS + cloudfl…
There are rumors twitter is talking to those guys about 140 len version, they are likely to be acquired. We need to wait to see. Tomorrow we should know.
Re: Left-pad as a service
#245The real discussion is not about package managers, micromodules, or whatever.
It's about "real programmers can write left_pad by themselves" and everybody else just sucks. True scotsmen etc.
Now I don't know why asm people arent feeling threatened and aren't attacking the C left_pad gurus yet...
Re: Left-pad as a service
#246for the graphic designers out there who need left-pad, blue-steel-pad is now available.
Re: Left-pad as a service
#247for the graphic designers out there who need left-pad, blue-steel-pad is now available.
Re: Left-pad as a service
#248Earlier quoted context omitted.
Except a good package manager will let you specify exactly which version you wish to depend upon, so any changes you make upstream will have no effect on people who protect themselves against automatic version updates. Seriously, the properties of good package management should be obvious by now. Any design that can break dependents and there's nothing they can do to protect themselves is broken.
And wait till you hear what a sufficiently smart compiler can do! http://c2.com/cgi/wiki?SufficientlySmartCompiler
But there already exist package managers that let you pin to a specific version like he's saying they should e.g. Maven, so I don't think your link quite applies here.
Re: Left-pad as a service
#249Earlier quoted context omitted.
> I don't understand why this community has to have a weekly cycle of bashing different programming communities. It's funny if done in good taste. You should be able to take a joke with good humour, even if it's at your own expense, and this is a pretty good joke.
I don't think the general commentary is in good taste. To me the difference between a good faith joke and a bad faith joke is whether you actually like the people you are making fun of. I don't think that's the case here. My sense is that the people laughing actually think NPM and JavaScript suck. The tone I am getting is "haha, you are bad and I am a better programmer than your whole community". Is that not how you…
I don't think people are making fun of other people here, we are lauhging at a particular software engineering pathology, that's all. There are important lessons in the story of left-pad library to be learned not only by JavaScript programmers, it's pretty universal, I remember someone asking about API for min and max for Java (not JavaScript) on StackOverflow.
Re: Left-pad as a service
#250Earlier quoted context omitted.
> Convenient proxy factory bean superclass for proxy factory beans that create only singletons. that actually makes sense to somebody?
At least it's convenient...
But it's kind of disturbing that the class name is hiding that convenience from us. How are we supposed to know that it is not an inconvenient...?
It all starts getting really weird with Spring Data interfaces: a whole DSL written in camelcased method names, as if Spring deliberately turned a joke into a feature.