Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

101–110 of 520 posts

Re: Many packages suddenly disappeared

#101

Post by no29 »

racbart wrote: post #5

PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…

maybe it's time to push for adding signed packages to npm

long discussion here: https://github.com/node-forward/discussions/issues/29

Re: Many packages suddenly disappeared

#102

Post by Pica_soO »

megaman22 wrote: post #23
sergiotapia wrote: post #9

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

Because it is... It's mollochian complexity heaped on top of layers of excrement and ducktape, and we have collectively entered a state of mass Stockholm Syndrome about the situation. I really would love to ditch web dev and all its myriad tendrils, and go back to native desktop software.

Somehow i imagine a native C-Desktopdev and a Webdeveloper meeting in No-Mans Land each party escaping from its own nightmare with that line on the lips, starting with a "Dont run into this direction-"

Re: Many packages suddenly disappeared

#103

Post by fiatjaf »

tw1010 wrote: post #34

I don't understand much about the blockchain, but one thing I have heard is that it's impossible (or very hard) to remove things from it. It is immutable, sort of append only, if I understand it correctly. So my question is, is there anyone working on moving npm to the blockchain? Or doing something like a package manager on the blockchain? If not, why not?

Your idea is awful, but you really shouldn't be downvoted.

It is better to use content hashes and a system that distributes and enforces these, like IPFS.

Someone could just create some hooks for https://github.com/whyrusleeping/gx and we would have it done.

Re: Many packages suddenly disappeared

#104

Post by jeanmichelx »

hateduser2 wrote: post #84
ris wrote: post #52

Earlier quoted context omitted.

Already counting down the days before yarn is considered old and broken and people are recommending switching to the next hot package manager/bundler...

It badfles me that technologists commonly complain about new technology. As far as I can tell your complaint boils down to “people should stop making and switching to new things”.. I find it hard to understand why someone with this attitude would be a technologist of any kind, and I find the attitude really obnoxious.

JS ecosystem is pretty well know for changing very fast compared to other mainstream languages. This is a fair point, NPM could implement the local cache without (hopefully) breaking anything

Re: Many packages suddenly disappeared

#105

Post by bastijn »

matharmin wrote: post #86
jogjayr wrote: post #71

In my org, we use Artifactory as a cache between us and external sources. They have a free version too. I'd encourage everyone to use it, or something like it. Stop pointing your package managers to the public registry.

What gives you more confidence in them? Just a better track record, or is it a fundamentally more reliable model?

It is fundamentally more secure as it functions as a private controlled proxy for the public repo. Also solves some other nice gotchas such as people pulling a left-pad joke on you and reproducible installs as all packages are cached so your build servers and dev systems get the same version of all packages (if properly used with shrinkwrap kind of solutions, or even without if properly handled).

Re: Many packages suddenly disappeared

#106

Post by notatoad »

lioeters wrote: post #89
sergiotapia wrote: post #9

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

As a counterpoint, couldn't any sufficiently complex structure be called a hack and a house of cards, when you really dig down into how it's put together? Mm, maybe not any - as some complex systems are well-tested with solid architecture - but just some, or most..

A "house of cards" implies that you don't have to dig to topple it. If you have to really dig down into how it's put together in order to start pulling it apart it isn't really a house of cards.

I don't use npm or node for anything serious, and i don't really have any knowledge of how NPM works, but this isn't the first time i've read this story of a whole bunch of packages disappearing and everybody's builds breaking. If everything is a house of cards, then why don't i hear the same stories about PyPI or gems or crates?

Re: Many packages suddenly disappeared

#107

Post by chomp »

hateduser2 wrote: post #84
ris wrote: post #52

Earlier quoted context omitted.

Already counting down the days before yarn is considered old and broken and people are recommending switching to the next hot package manager/bundler...

It badfles me that technologists commonly complain about new technology. As far as I can tell your complaint boils down to “people should stop making and switching to new things”.. I find it hard to understand why someone with this attitude would be a technologist of any kind, and I find the attitude really obnoxious.

I take it that you've never had to work at a big organization? When you have multiple teams in different offices, it's incredibly difficult to constantly "herd cats" and point everyone to $latest_fad. And when you DO by some miracle get everyone (devs and management) to switch to $latest_fad, it's a huge pain to go back through and bug test/change every process to accommodate the new software.

I don't think "people should stop making and switching to new things" is a fair distillation of the parent comment, as it seemed like they were just expressing frustration at the blistering pace the Javascript community is setting.

Re: Many packages suddenly disappeared

#108

Post by pul »

incogitomode wrote: post #13
racbart wrote: post #5

PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…

I just tested, and it definitely looks like a troll / hack. > duplexer3@1.0.1 install /Users/foo/Code/foo/node_modules/duplexer3 > echo "To every thing there is a season, and a time to every purpose under the heaven: A time to be born, and a time to die; a time to plant, and a time to pluck up that which is planted; A time to kill, and a time to heal; a time to break down, and a time to build up; A time to weep, and…

They're referencing the Bible: https://www.biblegateway.com/passage/?search=Ecclesiastes+3&...

Re: Many packages suddenly disappeared

#109

Post by james-mcelwain »

izacus wrote: post #61

Hmm, I Java world we pretty much always used a local (company-owned) Maven proxy server, which grabbed packages from public repos and cached them locally to make sure builds still work if public servers were down or slow... or packages disappeared. This isn't a standard practice in JS world?

Yes, of course. A centralized repository for a package manager is always going to be a single point of failure.

Re: Many packages suddenly disappeared

#110

Post by fcarraldo »

javajosh wrote: post #83
izacus wrote: post #61

Hmm, I Java world we pretty much always used a local (company-owned) Maven proxy server, which grabbed packages from public repos and cached them locally to make sure builds still work if public servers were down or slow... or packages disappeared. This isn't a standard practice in JS world?

Yes, for those who use `yarn`. (Yarn's package caching looks a lot like Mavens)

yarn does local caching in developer laptops. What GP is referring to is having an on-prem private dependency server which acts as a cache and proxy to the centralized public dependency repo.
Post reply on HN