Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Auto install npm dependencies as you code

npmjs.com

Post reply on HN
Print view View original

61–70 of 80 posts

Re: Show HN: Auto install npm dependencies as you code

#61

Post by concise_unicorn »

chr1 wrote: post #42
concise_unicorn wrote: post #7

Regular expressions are a very naive way of detecting calls to 'require'. For correctness you're better off recursively walking the AST. I've successfully used Detective in a couple of my personal projects to find all require statements. Relevant issue on Detective: https://github.com/substack/node-detective/issues/8

In practice regex gets all the require calls. And in many situations the very small percent of errors is outweighed by the huge advantage in performance that a simple regex provides. So i wouldn't call regex a 'very naive' choice, since people making it are aware of tradeoffs and pick regex intentionally.

It literally takes about 50ms to parse libraries like jQuery (mobile), angular and React with acorn[1].

Wether the choice was deliberate or not is debatable, but given the speed of these parsers I'd reason that there isn't any advantage to using regexes.

Reducing the amount of false positives is also one step closer to making this tool somewhat more secure, though certainly doesn't address any of the previous comments in this thread.

[1] http://esprima.org/test/compare.html

Re: Show HN: Auto install npm dependencies as you code

#63

Post by sotojuan »

yid wrote: post #39
micaksica wrote: post #21

Earlier quoted context omitted.

> The alternative is a tightly controlled standard library, but that isn't npm's stated goal. What npm says it is doing on paper and in its charter is not necessarily what npm gets used for. At this point in the ecosystem's maturity, npm developers are doing their users a massive disservice and opening them up to a lot of risk. Maintaining this line of a vibrant active community, and "developers should be responsible…

> As I see it, npm appears to be acting like there are a lot of unsolved problems in this realm, and in doing so are endangering a developer community that is absolutely full of amateurs. > The problem with npm is that the cost of entry of your "cool stuff" into the hands of a thousand trusting others is too low; there is no delineation between what is authoritative and what isn't. I agree that npm has been a bit slo…

Lodash is not a "FP" library—it's just a utility belt. And yes, it should be the authoritative IMO as it has the most support, users, and is worked on almost full time. It can be modular and each method can be installed separately, which is awesome.

Ramda is a utility belt that sticks to pure functional practices wherever it can, something the JS community doesn't do, so it shouldn't be the authoritative.

Underscore is dead and was replaced by Lodash.

While it's hard to do the above with all kinds of libraries, there are some where it's easy.

Re: Show HN: Auto install npm dependencies as you code

#64

Post by dozzie »

dack wrote: post #41
siddharthkp wrote: post #30

Earlier quoted context omitted.

That's interesting, tell me more?

I could be wrong, but I think he might mean that people should take care not to add too many dependencies to their project - if it's too easy, then it might result in unnecessary dependencies and brittle code. However, I'm not sure I agree with the statement - you could use this tool and still have the discipline not to pull in random packages.

The idea is that people in general go down the currently-easier way, which is "add the dependency", leading to microdependencies and left-pad idiocy in npm case.

If there is a friction, the balance is changed a little against pulling dependencies, at least those most trivial.

Re: Show HN: Auto install npm dependencies as you code

#65

Post by qwertyuiop924 »

siddharthkp wrote: post #44
cortesoft wrote: post #40

Earlier quoted context omitted.

Right, but when you are running npm install you know you are installing and so you know you should be careful, and only hit return if you are sure it is right. With this, you have to be careful the WHOLE time you are typing. You normally don't worry about hitting return in your editor causing RCE.

Good point, any ideas on handling this better? Opened an issue here: https://github.com/siddharthkp/auto-install/issues/2

The idea is inherently flawed. depandancy installation should be done as needed by people who are conciously aware of what they are doing. A better solution would be integrating NPM into your editor, so that package installation is trivial, but still explicit. M-x install-from-npm-region, anyone?

  (defun install-from-npm-region (start end)
    (interactive "r")
    (call-process 
      (concat "npm install " 
              (shell-quote-argument 
                (filter-buffer-substring start end)))
      nil
      (get-buffer-create "*NPM Output*")))
That function MIGHT install random things through NPM if your mark is unset, but it is, at least, explicit. And the random thing in question is your last region, so it's far more likely that NPM will just throw its hands and shout "what the hell?" Than actually install anthing...

Also note that that code hasn't been tested. I wouldn't copy this into my .emacs just yet, if I were you. Run it by somebody who actually knows elisp, first.

Re: Show HN: Auto install npm dependencies as you code

#66

Post by qwertyuiop924 »

pavel_lishin wrote: post #55
binarymax wrote: post #48

Earlier quoted context omitted.

If I understand correctly, this doesn't happen while you type, it happens after you save the file. Not much difference in care needed between saving a file or hitting enter IMO, if you are aware of the consequences. Also, its not like you don't know the thing is running - you'll subconsciously double check you typed the repo correctly before you save, knowing it will invoke an install.

Unless your IDE, like many, auto-saves files.

Even Emacs'll do that.

Re: Show HN: Auto install npm dependencies as you code

#67

Post by Etzos »

_RPM wrote: post #24
Etzos wrote: post #16

Earlier quoted context omitted.

It has to open and read a .js file already, it can certainly turn that into the representative AST for said file and then use the data from that. It will be slower, but it will also be more accurate and less likely to turn up false positives or miss things.

It has to parse a javascript file, which isn't trivial. The reason they use regular expression is because implementing a javascript parser isn't an easy problem to solve fast, even though the grammar is available.

One certainly does not need to implement a parser, just use one of the many available. As the sibling here pointed out the time it would take to parse and walk the AST is negligible compared to the downloads happening.

Re: Show HN: Auto install npm dependencies as you code

#68

Post by joelg »

Lots of people addressing security and remote code execution by typo.

Yes. You're right. If it scares you, don't use it.

It's always possible to run malicious code by typo, and this is only a little different from installing dependencies from the terminal. Even when you do spell a package's name correctly, you still don't know for sure what you're installing.

The guy just made a cool thing - it seems a little out-of-scope to freak out over security when npm was never really there.

Re: Show HN: Auto install npm dependencies as you code

#69

Post by siddharthkp »

joelg wrote: post #68

Lots of people addressing security and remote code execution by typo. Yes. You're right. If it scares you, don't use it. It's always possible to run malicious code by typo, and this is only a little different from installing dependencies from the terminal. Even when you do spell a package's name correctly, you still don't know for sure what you're installing. The guy just made a cool thing - it seems a little out-of-…

Thanks for the support :)

The concerns are fair though, just added a --secure flag which will install popular modules only (>10k downloads last month)

Post reply on HN