There are over 700 comments on this issue on GitHub. It is turning into live chat room. https://github.com/npm/registry/issues/255 Be part of the history :) EDIT: there are now over 1100 comments/memes.
the comments are literally making my Saturday
Many packages suddenly disappeared
161–170 of 520 posts
Re: Many packages suddenly disappeared
#162Earlier quoted context omitted.
A "house of cards" implies that you don't have to dig to topple it. If you have to really dig down into how it's put together in order to start pulling it apart it isn't really a house of cards. I don't use npm or node for anything serious, and i don't really have any knowledge of how NPM works, but this isn't the first time i've read this story of a whole bunch of packages disappearing and everybody's builds breakin…
It reminds me of this article, Everything is Broken. Perhaps a house of cards becomes solid architecture through the test of time..? https://medium.com/message/everything-is-broken-81e5f33a24e1
The issues with the NPM Registry are not technical but management issues and decisions not properly thought through.
Re: Many packages suddenly disappeared
#163Hmm, I Java world we pretty much always used a local (company-owned) Maven proxy server, which grabbed packages from public repos and cached them locally to make sure builds still work if public servers were down or slow... or packages disappeared. This isn't a standard practice in JS world?
Yes, if your company has Artifactory or similar. I think most of these outraged folks are just memeing.
Re: Many packages suddenly disappeared
#164Earlier quoted context omitted.
Dunno, but it's quite hard to resist childish urges. I note that "jew" is still available, and .jew is a perfectly valid extension which no program has ever claimed. I love all cultures. There's something worth learning from each of them, if you try. But emergent social dynamics are deeply interesting too: I get it (everyone does), and it makes perfect sense. Yet we've all collectively agreed that those are unwholeso…
> And you'll find it difficult to turn "Forget" into a file extension. I must be missing something, but wouldn't .forget be the file extension you're looking for?
Ah, good point. Though that's a bit like using .hackernews instead of .hn.
Re: Many packages suddenly disappeared
#165Earlier quoted context omitted.
Because it is... It's mollochian complexity heaped on top of layers of excrement and ducktape, and we have collectively entered a state of mass Stockholm Syndrome about the situation. I really would love to ditch web dev and all its myriad tendrils, and go back to native desktop software.
Somehow i imagine a native C-Desktopdev and a Webdeveloper meeting in No-Mans Land each party escaping from its own nightmare with that line on the lips, starting with a "Dont run into this direction-"
Eh, i like desktop development and i make desktop apps for 20+ years. Before i got Windows 95 i was even trying to make my own DE for DOS in Turbo Pascal and before that in GW-BASIC :-P. I love the desktop.
Web stuff on the other hand can die in a fiery death, as far as i am concerned together with mobile stuff they are the source of everything wrong with the desktop today :-P.
Re: Many packages suddenly disappeared
#166Earlier quoted context omitted.
seems like a good reflection of the current social climate: they have a policy to prevent mildly offensive package names, and they enforce it, but they don't have a solution to packages randomly disappearing and being replaced with malicious versions.
The term "nazi" is not simply mildly offensive, there are likely legal implications if you want to serve users in Germany.
I doubt they did it out of a desire to better serve users in Germany.
Re: Many packages suddenly disappeared
#167> I was here.
> We made history! Fastest issue to reach 1000 comments, in just 2 hours.
> cheers everyone, nice chatting with you. 17 away from hitting 1000 btw!
> Is GitHub going to die with the volume of comments?
Kind of disappointed the NPM community is turning github into reddit right now.
Re: Many packages suddenly disappeared
#168Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?
I have recently taken over an Angular project (with a C# backend, thankfully) at my job. It took two hours to get it to even compile correctly because some dependencies were apparently outdated in package.json and it just ran on the other dev's machine by accident. I don't understand why I need over 100 dependencies for a simple Angular Single Page App that pulls JSON from the backend and pushes JSON back. Meanwhile,…
Does that backend use nuget for dependencies?
Re: Many packages suddenly disappeared
#169Earlier quoted context omitted.
And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…
> Is there a valid defense for a platform whose security relies on the unanimous cooperation of a widely-scattered developer base? The defense is staged deployment and active users. This obviously depends on the blutness of the malicious code. If I may assume easily noticed effects of the malicious code: A dev at our place - using java with maven - would update the library, his workstation would get owned. This could…
Sounds like good hygiene, though it seems burdensome if everyone must do it or seriously risk infection. Ideally there would be at least minimal sanity checks and a formal process before a package can be claimed by someone else.
Re: Many packages suddenly disappeared
#170Earlier quoted context omitted.
Because each thing has a constant price in learning effort that is familiarizing yourself with its idiosyncrasies, which you have to pay even if you're experienced in the domain. When tools constantly get replaced instead of improved, you keep paying that price all the time.
It’s a drop-in replacement CLI tool. Let’s not be dramatic.
To be completely fair, it isn't exactly drop-in. There's new commands for a bunch of things, mainly around adding new packages locally and globally. I led the yarn switch effort on my direct team and had people coming to me weeks after asking how to do X because of the different commands.