361–370 of 520 posts
I wish I'd taken his advice as there are a couple of JAR files that I can no longer update.
Earlier quoted context omitted.
A bit like PHP in that way?
Well, kind of. Node was not a general purpose tool as conceived initially. You would write some I/O bound servers in it. And PHP too is not a general purpose tool, it is for writing interactive web pages (in its pre-Web2.0 sense) easily. Though Node.js was way more intellectually designed. I don't know much about PHP, but there's lots of literature (see https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ ).
Besides, the author seems to misunderstand a great many things about PHP and languages in general. Here's a short rebuttal (also from April 2012): https://blog.ircmaxell.com/2012/04/php-sucks-but-i-like-it.h... that explains some of the misunderstandings.
Earlier quoted context omitted.
Any chance of a technical write-up so that we can all learn from whatever happened?
Absofuckinglutely. It's being done as we speak.
Earlier quoted context omitted.
It reminds me of this article, Everything is Broken. Perhaps a house of cards becomes solid architecture through the test of time..? https://medium.com/message/everything-is-broken-81e5f33a24e1
The issues with the NPM Registry are not technical but management issues and decisions not properly thought through.
It might well have been technical. It might well have been managerial. It very likely involved elements of both. But don't you think it's best to save the Monday morning quarterbacking for Monday morning, when all the facts are in?
Earlier quoted context omitted.
Somehow i imagine a native C-Desktopdev and a Webdeveloper meeting in No-Mans Land each party escaping from its own nightmare with that line on the lips, starting with a "Dont run into this direction-"
At my job we do native C and C++, some Java, some C#, scripting in Shell, Python, and Perl. When the left-pad incident happened someone said something to the room about it, we all looked it up, and spent a good 15 minutes mind-boggled, laughing and being grateful we weren't web devs. "Wait, you're telling me these people need NPM and GitHub to deploy? Seriously?"
"Wait, you're telling me these people need an internet-available Ubuntu mirror to install their development environments?"
"Wait, you're telling me these people need their users to have specific, updated browsers in order to run the deployed software?"
"Wait, you're telling me these people need their users to have a patched, up-to-date operating system in order to run your desktop app?"
"Wait, you're telling me these people just assume users won't switch off their computers before saving changes?"
"Wait, you're telling me these people depend on the power grid being available to deploy?"
"Wait, you're telling me these people assume their users have fast, low-latency internet connections to play their real-time multiplayer game?"
You get the idea.
Earlier quoted context omitted.
And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…
On top of that, they way countless packages are used everywhere is potentially exploitable: https://medium.com/@david.gilbertson/im-harvesting-credit-ca...
Earlier quoted context omitted.
> incorrectly written program In principle programs shouldn't stop working just because they are old. Yes, no language completely realize this. But there's a world of difference between C's "it was written only 40 years ago, why did compilers break it?" to Python's "yes, you are expected to review your code every 3 or 4 years", and there is another world of difference to the faster Javascript frameworks that practice…
No JS framework does that because they version things. Run the same versions and it works. If you’re not pinning versions correctly that’s hardly JS’s fault.
Earlier quoted context omitted.
>these people need [their package manager] and [their source code management tool] to deploy? Seriously? Not really sure I understand what you're implying there
A public package manager and a public source code management tool, both of which are outside of your control. You should be able to deploy from a local [verified and audited] cache of your dependencies.
Itty bitty company making a social website on a shoestring budget/runway with very few developers? Might just be worth postponing a release a day or two if NPM or GitHub are having issues.