Live data from Hacker News

Many packages suddenly disappeared

github.com

41–50 of 520 posts

Re: Many packages suddenly disappeared

#41
post #17

Gah. Moments like these always gives me a bit of panic, since I realize that so much of my software relies on external sources. Relying on npm, Atlassian/GitHub etc really hurts when stuff like this happens. Issues always gets resolved, but cases such as the GitLab incident should be enough to always keep some local copies around.

> Gah. Moments like these always gives me a bit of panic, since I realize that so much of my software relies on external sources.

Install an instance of Sonatype Nexus, create a proxy-repo for npm (and Maven if you also use Java) and that's it.

What, however, won't be caught is Docker (because that crap insists on directly talking to the Dockerhub servers, which is a giant security hole waiting to happen) and PHP composer (because it likes to pull dependencies via git from GH, so no caching there).

Re: Many packages suddenly disappeared

#42
post #15

So, funny story: I registered the "nazi" npm package. When you require it, it says "I did nazi that coming." That's it. (Though it would've been a funny name for a linter.) ... Or it did. I received a harshly worded letter from npm saying they axed it. It hit all the talking points about inclusiveness and making sure no one feels even slightly annoyed. Meh. No point to this story. Just an interesting situation with a…

They document that they curate package names here:

https://www.npmjs.com/policies/conduct

I guess lots of people will think that a policy like Avoid using offensive or harassing package names, nicknames, or other identifiers that might detract from a friendly, safe, and welcoming environment for all. stifles their inner something or other though.

Re: Many packages suddenly disappeared

#43

Earlier quoted context omitted.

What's the alternative? Have the maintainer snail-mail you the packages?

You run a private NPM mirror where you copy dependencies that you rely on, after auditing them (for code quality and licensing).

This, or if you have the money there are companies that do that for you.

Re: Many packages suddenly disappeared

#44
Btw. for those who don't know:

Yarn (which is an alternative to npm) uses a global cache [1] on your machine which speeds things up, but probably also protects you from immediate problems in cases like the one currently on progress (because you would probably have a local copy of e.g. require-from-string available).

[1] https://yarnpkg.com/lang/en/docs/cli/cache/

Re: Many packages suddenly disappeared

#48
post #15

So, funny story: I registered the "nazi" npm package. When you require it, it says "I did nazi that coming." That's it. (Though it would've been a funny name for a linter.) ... Or it did. I received a harshly worded letter from npm saying they axed it. It hit all the talking points about inclusiveness and making sure no one feels even slightly annoyed. Meh. No point to this story. Just an interesting situation with a…

Does "stalinist" work?

Dunno, but it's quite hard to resist childish urges. I note that "jew" is still available, and .jew is a perfectly valid extension which no program has ever claimed.

I love all cultures. There's something worth learning from each of them, if you try. But emergent social dynamics are deeply interesting too: I get it (everyone does), and it makes perfect sense. Yet we've all collectively agreed that those are unwholesome.

And it's doubly interesting because it's easy to think of cases that wouldn't be funny at all, even in theory. New Geometry Representation might be a fine name for a new format, but you're not going to use its acronym. So then what separates the latter case from the former? And you'll find it difficult to turn "Forget" into a file extension.

Yet this is all very English-centric. I've often wondered whether foreign users ever get annoyed with some of our names that happen to acronym to something unfortunate in their native language. Do they just have to live with it, or does it never happen? What if "emacs" was a smear in Portuguese, or "vim" was an unspeakable slur in India? "Coq" was named Coq partly so the dev would be able to unironically give conference talks about Coq. Was that only allowed because its author is French? All kinds of interesting questions!

I don't know. Just pointless thoughts. Personally I'm happy npm values quality; complete anarchy might not necessarily work.

Or maybe it would. I've always wondered what would happen if we develop clones of popular systems but with zero controls. Even 4chan has moderators. But HN user "baby" recently made a blockchain based image board that was theoretically impossible to control. How would people behave in such a situation? Who would you even punsh?

It's so fun to think about.

Re: Many packages suddenly disappeared

#49

Earlier quoted context omitted.

What's the alternative? Have the maintainer snail-mail you the packages?

You run a private NPM mirror where you copy dependencies that you rely on, after auditing them (for code quality and licensing).

Wouldn't just pinning the hash of a package be a better solution?

Re: Many packages suddenly disappeared

#50

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

I have recently taken over an Angular project (with a C# backend, thankfully) at my job. It took two hours to get it to even compile correctly because some dependencies were apparently outdated in package.json and it just ran on the other dev's machine by accident. I don't understand why I need over 100 dependencies for a simple Angular Single Page App that pulls JSON from the backend and pushes JSON back. Meanwhile, the C# backend (a huge, complicated behemoth of software) ran on the first click.
Post reply on HN