Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

111–120 of 520 posts

Re: Many packages suddenly disappeared

#111

Post by TeMPOraL »

hateduser2 wrote: post #84
ris wrote: post #52

Earlier quoted context omitted.

Already counting down the days before yarn is considered old and broken and people are recommending switching to the next hot package manager/bundler...

It badfles me that technologists commonly complain about new technology. As far as I can tell your complaint boils down to “people should stop making and switching to new things”.. I find it hard to understand why someone with this attitude would be a technologist of any kind, and I find the attitude really obnoxious.

Because each thing has a constant price in learning effort that is familiarizing yourself with its idiosyncrasies, which you have to pay even if you're experienced in the domain. When tools constantly get replaced instead of improved, you keep paying that price all the time.

Re: Many packages suddenly disappeared

#113

Post by barneygale »

notatoad wrote: post #96
maxerickson wrote: post #42

Earlier quoted context omitted.

They document that they curate package names here: https://www.npmjs.com/policies/conduct I guess lots of people will think that a policy like Avoid using offensive or harassing package names, nicknames, or other identifiers that might detract from a friendly, safe, and welcoming environment for all. stifles their inner something or other though.

seems like a good reflection of the current social climate: they have a policy to prevent mildly offensive package names, and they enforce it, but they don't have a solution to packages randomly disappearing and being replaced with malicious versions.

It's a shame there are enough edgy teenagers making npm packages that such a policy is warranted

Re: Many packages suddenly disappeared

#114

Post by ake1 »

izacus wrote: post #61

Hmm, I Java world we pretty much always used a local (company-owned) Maven proxy server, which grabbed packages from public repos and cached them locally to make sure builds still work if public servers were down or slow... or packages disappeared. This isn't a standard practice in JS world?

i use yarn-offline-mirror and save all tarballs in the repository, works fairly well.

Re: Many packages suddenly disappeared

#115

Post by eropple »

nukeop wrote: post #95
swang wrote: post #64

Earlier quoted context omitted.

this is not a response? http://blog.npmjs.org/post/168978377570/new-package-moniker-...

That's okay, but it's not enough - it's easy to swap two letters and do similar substitutions to fool many users. If a package is downloaded 10,000 times every day, surely once in a while someone will misspell the name somehow. Other than that, their reaction to similar incidents was to wait for somebdoy on twitter to notify them, ban the responsible users, and hope that it won't happen again. It's still extremely ex…

Yup. The best answer I can come up with given their constraints (some self-imposed) is to force all new packages to be scoped.

Re: Many packages suddenly disappeared

#116

Post by j3097736 »

fiatjaf wrote: post #103
tw1010 wrote: post #34

I don't understand much about the blockchain, but one thing I have heard is that it's impossible (or very hard) to remove things from it. It is immutable, sort of append only, if I understand it correctly. So my question is, is there anyone working on moving npm to the blockchain? Or doing something like a package manager on the blockchain? If not, why not?

Your idea is awful, but you really shouldn't be downvoted. It is better to use content hashes and a system that distributes and enforces these, like IPFS. Someone could just create some hooks for https://github.com/whyrusleeping/gx and we would have it done.

Already done https://github.com/diasdavid/npm-on-ipfs tough it doesn't seem to be mantained anymore.

Re: Many packages suddenly disappeared

#117

Post by applecrazy »

yladiz wrote: post #33

I don't remember the intricacies of NPM or Yarn, but don't one/both of them have resource integrity enabled, so that you know that the package that's being installed is the one in your lock file? If not, why isn't this a feature especially after the clusterfuck of the guy deleting all his packages back about two years ago, breaking tons of things including Babel and React? This wouldn't fix the issue of someone delet…

Can you link me to the incident where a person deleted their packages and broke Babel? I'd love to read about it.

Edit: grammar

Re: Many packages suddenly disappeared

#119

Post by taurath »

This is insane. This is like Google changing their v1 APIs, except worse since ANYONE could come in and put new malicious APIs up in its place. I say this as a firm supporter of Node and the ecosystem - this should NEVER EVER be allowed to occur. This completely erodes the trust model based around "popular packages" even further - the only saving grace is that hopefully most devs are shrinkwrapping their modules.

Re: Many packages suddenly disappeared

#120

Post by [deleted] »

barneygale wrote: post #113
notatoad wrote: post #96

Earlier quoted context omitted.

seems like a good reflection of the current social climate: they have a policy to prevent mildly offensive package names, and they enforce it, but they don't have a solution to packages randomly disappearing and being replaced with malicious versions.

It's a shame there are enough edgy teenagers making npm packages that such a policy is warranted

[deleted]
Post reply on HN