Many packages suddenly disappeared • Hacker News Board

Re: Many packages suddenly disappeared

#421

Post by pen2l » Sun, Jan 07, 2018, 4:51 AM UTC

danso wrote: post #227

rubyn00bie wrote: post #158

Earlier quoted context omitted.

I’m pretty sure they’re referencing the Byrds song and not the Bible directly: https://m.youtube.com/watch?feature=youtu.be&v=pKP4cfU28vM

No. The Byrds song, which is itself an excerpt/phrase of Ecclesiastes, does not have phrases like " and a time to pluck up that which is planted "

Not to mention, it’s a Pete Seeger song, the byrds just covered it. I may be wrong but I think Seeger wrote it for Judy Collins to sing.

Edit: ok nope, Seeger didn’t “write” it for Collins, she’s just another one to cover it. Here they are both doing it if you’re interested: https://youtu.be/fA9e-vWjWpw

Re: Many packages suddenly disappeared

#422

Post by not_kurt_godel » Sun, Jan 07, 2018, 5:06 AM UTC

zbentley wrote: post #368

rabidrat wrote: post #281

Earlier quoted context omitted.

A public package manager and a public source code management tool, both of which are outside of your control. You should be able to deploy from a local [verified and audited] cache of your dependencies.

That's a good goal to strive for, but isn't necessary or practical for everyone. Maintaining local/hosted artifact caches, verifying them, and auditing them is a big hassle, and unless you make something (e.g. fintech, healthtech) that might need such an audit or emergency release, might not be worth the trouble. Itty bitty company making a social website on a shoestring budget/runway with very few developers? Might…

virtualenv makes it trivial. It's not like it's strictly enterprise-grade tech.

Re: Many packages suddenly disappeared

#423

Post by not_kurt_godel » Sun, Jan 07, 2018, 5:12 AM UTC

rmrfrmrf wrote: post #334

TeMPOraL wrote: post #223

Earlier quoted context omitted.

The problem isn't with that one tool alone. The problem is with the entire ecosystem, in which all the tools get regularly replaced by "better" ones. It all adds up.

To be precise, new tools are continuously created to address the weaknesses of other tools. This happens in other languages, just more slowly due to smaller community sizes.

What ideally should be happening is that existing tools get incrementally upgraded to fix issues and add improvements rather than scrapped and replaced as if they're disposable.

Re: Many packages suddenly disappeared

#424

Post by shostack » Sun, Jan 07, 2018, 5:18 AM UTC

eric_h wrote: post #194

csdreamer7 wrote: post #126

Earlier quoted context omitted.

How does RubyGems handle a package being removed and replaced by a different (and maybe malicious) actor? Not allow a package to be deleted? Block the package name from being claimed by someone else?

From http://help.rubygems.org/kb/gemcutter/removing-a-published-r... : > Once you've yanked all versions of a gem, anyone can push onto that same gem namespace and effectively take it over. This way, we kind of automate the process of taking over old gem namespaces.

So basically--gem bundler beware?

Re: Many packages suddenly disappeared

#425

Post by chris_7 » Sun, Jan 07, 2018, 5:25 AM UTC

vitaliyf wrote: post #25

StavrosK wrote: post #19

Earlier quoted context omitted.

What's the alternative? Have the maintainer snail-mail you the packages?

You run a private NPM mirror where you copy dependencies that you rely on, after auditing them (for code quality and licensing).

I don't know JS, but this sounds like a lot more work than just checking everything into your repo?

Re: Many packages suddenly disappeared

#426

Post by majormajor » Sun, Jan 07, 2018, 5:27 AM UTC

marcosdumay wrote: post #416

zbentley wrote: post #386

Earlier quoted context omitted.

> using political correctness to bully people around them. "Please don't use unnecessarily harmful/crude/we-don't-like-it language when giving names to pieces of computer software that we host, manage, and coordinate for you " counts as bullying now? I think not. As they say, if you don't like it, don't play. And besides, NPM seems pretty focused on package names alone (as they should be). If you absolutely must live…

It certainly does not count as bullying. But people do have knee-jerk reactions, and people do overreact for fear of it being bullying next time. None of those are likely to be necessary on this case, but people's feeling aren't very contextual. Many people will react to overreaching political correctness for fear alone, and it isn't nice for the GP to accuse them of bullying.

Yes, it's sad what people do out of fear. But excusing and ignoring unpleasant behavior as a "knee-jerk reaction" or "overreaction," and complaining about someone criticizing it, has many, many dangers of its own.

Re: Many packages suddenly disappeared

#427

Post by eropple » Sun, Jan 07, 2018, 5:36 AM UTC

didibus wrote: post #394

tetha wrote: post #209

Earlier quoted context omitted.

Mh, I have a rather aggressive stance on these kind of incidents, no matter if they are availability or security related. You can fish for them, you can test for them, and there are entire classes of malicious code you cannot find. For everything you do, turing complete code can circumvent it. There's a lot of interesting reading material going on in the space of malware analysis regarding sandbox detection, for exam…

What if it encrypts user data?

You have your tested backups, yeah?

Re: Many packages suddenly disappeared

#428

Post by valuearb » Sun, Jan 07, 2018, 5:37 AM UTC

nukeop wrote: post #300

corndoge wrote: post #285

Earlier quoted context omitted.

typical JavaScript engineering

Javascript is a very handy language, it's held back by all the gymnastics it needs to do to get over browser/www limitations, and an influx of low skill developers with no diploma.

Hey, I’ve got no diploma, just 30 years of commercial development. But even I know that all the unit tests in the world can’t paper over the flaws of a typeless scripting language.

Re: Many packages suddenly disappeared

#429

Post by h1d » Sun, Jan 07, 2018, 5:47 AM UTC

Is there a possibility that npm turn package names into "author/package" style, so there would be less confusion on what the users are installing and less chance of name squatting?

Re: Many packages suddenly disappeared

#430

Post by tonyarkles » Sun, Jan 07, 2018, 5:49 AM UTC

tonyarkles wrote: post #414

dadvader wrote: post #375

Earlier quoted context omitted.

> it's held back by all the gymnastics it needs to do to get over browser/www limitations, I suppose, but I think it's the javascript "nature" ( dynamic typing along with the scripting style of wanting to be a "swiss knife" to solve all problems ). Javascript, like perl and even C, gives you a lot of rope to hang yourself. And like perl and C, javascript initially seems simple and easy and it deceives you into thinki…

> Plenty of incompetent developers at all levels and all languages. I don't think it's a javascript issue. While that's potentially true, I do suspect that there's a lot fewer, say, Haskell, Clojure, or Elixir developers than there are for some other languages. Not that they don't exist, but it seems unlikely that you'd cross paths with them.

Just realized I meant to say "a lot fewer, say, incompetent..."