Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

451–460 of 520 posts

Re: Many packages suddenly disappeared

#451

Post by fold_left »

jogjayr wrote: post #305
Silhouette wrote: post #279

Earlier quoted context omitted.

Stop pointing your package managers to the public registry. Unfortunately with NPM this is still awkward, because as soon as you try to shrinkwrap your project, it doesn't just pin the version numbers, it also pins the full source location. That's in direct conflict with (and apparently takes precedence over) using one of the local caching proxies that would otherwise be a useful practical solution to this problem, a…

Don't use shrinkwrap - this comes directly from Laurie Voss, COO of NPM Inc. In my own experience using npm shrinkwrap has been pretty bad. NPM has its own lockfiles now, similar to yarn. > It has a few problems of its own, notably surprising, quiet updates to the lock file when using the default options This I've never noticed. I'm genuinely curious how it would happen. The only way I imagine it might happen is if y…

Note that shrinkwrap and npm 5 lockfiles are identical, running npm shrinkwrap just renames the file.

Re: Many packages suddenly disappeared

#452

Post by klibertp »

tonyarkles wrote: post #430
tonyarkles wrote: post #414

Earlier quoted context omitted.

> Plenty of incompetent developers at all levels and all languages. I don't think it's a javascript issue. While that's potentially true, I do suspect that there's a lot fewer, say, Haskell, Clojure, or Elixir developers than there are for some other languages. Not that they don't exist, but it seems unlikely that you'd cross paths with them.

Just realized I meant to say "a lot fewer, say, incompetent ..."

Well, both versions are true, the latter mostly following from the former. With a lower absolute number of developers, the number of incompetent programmers is going to be lower in absolute terms, despite the ratio staying the same as in other languages.

But I believe there's a difference in the ratio, too, due to the way Haskell, Erlang, Lisp, etc. programmers learn these languages. Basically, they learn the languages not because someone wants them to (eg. Java, C#, etc.) and not because they have to just to be able to do something they want to do (eg. JavaScript, SQL, etc.). Instead, people learn such languages because they themselves want to, which makes them more probable to delve deeper, learn more and acquire more important skills.

Well, that's a conjecture I can't prove and I may be completely wrong on this, it's just what my anecdotal experience suggests.

Re: Many packages suddenly disappeared

#453

Post by fold_left »

krapp wrote: post #234

This may be a stupid question - I'm not that familiar with NPM or modern javascript development so forgive me, but does it not allow storing your dependencies locally? Is that not considered best practice? Just download your entire dependency tree and don't touch it unless you have to. It seems to me that if packages "disappear" from upstream, it shouldn't have any effect other than preventing an update due to the mi…

You can create a local offline mirror using the shrinkpack (not shrinkwrap) tool.

Re: Many packages suddenly disappeared

#455

Post by tzs »

mschuster91 wrote: post #60
shawn wrote: post #48

Earlier quoted context omitted.

Dunno, but it's quite hard to resist childish urges. I note that "jew" is still available, and .jew is a perfectly valid extension which no program has ever claimed. I love all cultures. There's something worth learning from each of them, if you try. But emergent social dynamics are deeply interesting too: I get it (everyone does), and it makes perfect sense. Yet we've all collectively agreed that those are unwholeso…

> But HN user "baby" recently made a blockchain based image board that was theoretically impossible to control. How would people behave in such a situation? Who would you even punsh? Probably will get scooped up by pedophiles sooner or later, followed by a couple high profile arrests and everyone will be scared shitless to run a node for that blockchain. CP has always been a good source of scare for Tor exit node ope…

> Actually, from a libertarian POV I really like the idea, both behind an uncensorable imageboard and Tor, but the simple fact that pedophiles and Nazis can and will abuse the openness for their vile gains makes me believe that the world will probably never be ready for such a thing as widespread service.

Similar considerations are why I never ran a Tor exit node, despite my inner geek wanting to as soon as I heard about it because the technology is cool.

The deciding factor was that almost every good thing that I could think of or that people suggested that a truly anonymous, untraceable, non-moderated, anybody to anybody communication system could be used for were things that could be reasonably accomplished by other means that are not as open to abuse.

For example, a common scenario offered is someone inside an oppressive regime working to document the regime's abuses and bring it down. They would be tortured and killed (and possibly so would their family) if their identity became known.

But they just need a need a secure channel to a trusted contact outside the reach of the regime who can relay messages for them. It does not have to be an anybody to anybody channel or a non-moderated channel.

The only things I could think of that really need something like Tor are things where what you are doing is so near universally frowned upon that there is almost nobody willing to be publicly associated with facilitating it.

Re: Many packages suddenly disappeared

#456

Post by tzs »

shawn wrote: post #48
shrimp_emoji wrote: post #29

Earlier quoted context omitted.

Does "stalinist" work?

Dunno, but it's quite hard to resist childish urges. I note that "jew" is still available, and .jew is a perfectly valid extension which no program has ever claimed. I love all cultures. There's something worth learning from each of them, if you try. But emergent social dynamics are deeply interesting too: I get it (everyone does), and it makes perfect sense. Yet we've all collectively agreed that those are unwholeso…

> What if "emacs" was a smear in Portuguese, or "vim" was an unspeakable slur in India?

You can even get this kind of problem without involving a different language, because words can have different meaning in different fields.

There is a (probably) urban legend about a mathematics grad student working in algebraic geometry returning from a conference, who finds he is sharing the security line at the airport with another conference attendee and they start chatting about algebraic geometry, talking about "blowing up points on a plane". It does not go over well with the non-mathematicians in line or with the TSA agents.

Efim Zelmanov, a noted algebraist, tells of being stopped by the KGB on the way to a conference and being questioned at length because he had books with him about "free groups" and "radicals".

Re: Many packages suddenly disappeared

#457

Post by klibertp »

TeMPOraL wrote: post #111
hateduser2 wrote: post #84

Earlier quoted context omitted.

It badfles me that technologists commonly complain about new technology. As far as I can tell your complaint boils down to “people should stop making and switching to new things”.. I find it hard to understand why someone with this attitude would be a technologist of any kind, and I find the attitude really obnoxious.

Because each thing has a constant price in learning effort that is familiarizing yourself with its idiosyncrasies, which you have to pay even if you're experienced in the domain. When tools constantly get replaced instead of improved, you keep paying that price all the time.

> Because each thing has a constant price in learning effort

That's not, in my experience, how it works. Learning your first tool (or language) takes a lot of time. Learning your second is quicker. By the tenth, you're able to learn it by skimming the README and changelog.

It works like this for languages too, at least for me. My first "real" language (aside from QBasic) was C++ and it took me 3-4 years to learn it to an acceptable degree. Last week I learned Groovy in about 4 hours.

It still "adds up", but to a much lower value than you'd think.

Re: Many packages suddenly disappeared

#458

Post by 59nadir »

ytpete wrote: post #338
maxander wrote: post #121

Earlier quoted context omitted.

And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…

With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. Really seems like deleted packages should be frozen forever - if the original author never recreates it or transfers ownership, then people would have to explicitly choose to move to some new fork with a new id. But your point about pressuring or bribi…

It's just npm that's broken. I've never used a package manager for any other language that had these kinds of issues. It's exacerbated by the massive over-reliance on external packages in JS too. `left-pad` really shone a light on how dependencies in JS land really are brought in without too much thought.

Re: Many packages suddenly disappeared

#459

Post by TeMPOraL »

klibertp wrote: post #457
TeMPOraL wrote: post #111

Earlier quoted context omitted.

Because each thing has a constant price in learning effort that is familiarizing yourself with its idiosyncrasies, which you have to pay even if you're experienced in the domain. When tools constantly get replaced instead of improved, you keep paying that price all the time.

> Because each thing has a constant price in learning effort That's not, in my experience, how it works. Learning your first tool (or language) takes a lot of time. Learning your second is quicker. By the tenth, you're able to learn it by skimming the README and changelog. It works like this for languages too, at least for me. My first "real" language (aside from QBasic) was C++ and it took me 3-4 years to learn it t…

But it does, you're just focusing on the other component of learning.

Put another way, for a new tool, learning cost is a sum of a) cost of learning idiosyncrasies of that tool, and b) cost of getting familiar with the concepts used by it.

You're talking about b), which is indeed a shared expense. But a), by definition, isn't. And it's always nonzero. And since new tools are usually made to differ from previous ones on purpose ("being opinionated", it's called), even though they fix some minor things, this cost can be meaningful. And, it adds up with every switch you need to do.

Some of it is a normal part of life of a software developer, but JS ecosystem has taken it to ridiculous extremes.

Post reply on HN