Earlier quoted context omitted.
I've known plenty of developers whose automatic response to `packagemanager install packagename` failing is `sudo packagemanager install packagename`.
I sincerely hope all modern package managers, when invoked with sudo, immediately spawn a very-low-privilege process that does most of the work sandboxed to /tmp/whatnot, and the root process just copies files to the right place and runs some system calls to update databases etc.
Many packages suddenly disappeared
461–470 of 520 posts
Re: Many packages suddenly disappeared
#462Earlier quoted context omitted.
With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. Really seems like deleted packages should be frozen forever - if the original author never recreates it or transfers ownership, then people would have to explicitly choose to move to some new fork with a new id. But your point about pressuring or bribi…
> With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. CPAN requires the old author to explicitly transfer or mark it abandoned-and-available-to-new-owner. For all the things wrong with perl5 (and I love it dearly but have spent enough time I can probably list more things wrong with it than the people wh…
Re: Many packages suddenly disappeared
#463And this is why I avoid "package managers" that follow the wild-west model like the plague.
What's the wild-west model? Write it all yourself? "cp -r $dependency_location $install_location"? Genuinely curious.
In short, package authors don't tend to care about much more than getting their package to work, somehow, anyhow. Often only the latest version of that package, too. And they don't always have an eye on interoperability with other packages, or consistency across a collection. Maintainers who create a "distribution" of software that works well together can collaboratively make decisions that are in the community's best interest. The "wild west" model is unilateral, the "maintained" model is multi-lateral.
Re: Many packages suddenly disappeared
#464Earlier quoted context omitted.
> With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. CPAN requires the old author to explicitly transfer or mark it abandoned-and-available-to-new-owner. For all the things wrong with perl5 (and I love it dearly but have spent enough time I can probably list more things wrong with it than the people wh…
This happens all the time. The new generation creates something cool because what our parents created isnt cool any more, only to fail exactly on the same spot as our parents. Only, it was already solved in the parents last version. This goes for cloth design, cars, houses, kitchen wares and so on, as well as software. Just look at the microwave oven earlier...
Re: Many packages suddenly disappeared
#465Earlier quoted context omitted.
What's the wild-west model? Write it all yourself? "cp -r $dependency_location $install_location"? Genuinely curious.
The "wild west" model is where there is no maintainer or distributor between the developer and consumer that is allowed to perform any sort of quality control or sanitisation. That sounds good from a naive standpoint - who needs this busybody middleman anyway? But the problem is that authors tend not to be great maintainers. Authors can (and do) remove packages at any time, make changes to packages without bumping ve…
That's not entirely true. Maintainers or distributors aren't required under the "wild-west" model, but that's not the same as anything being disallowed. It's up to the community and the developer to do their own due diligence. The "wild west" model is just the free software model, it's just the lack of some central authority limiting user freedom for the good of the community.
Rather, it's the "distribution" model which forbids anything not approved by the list of official maintainers. All of the problems you list with package authors still exist, but you have fewer options as a developer should they arise.
Re: Many packages suddenly disappeared
#466What an ecosystem we have built.
Re: Many packages suddenly disappeared
#467Earlier quoted context omitted.
> Because each thing has a constant price in learning effort That's not, in my experience, how it works. Learning your first tool (or language) takes a lot of time. Learning your second is quicker. By the tenth, you're able to learn it by skimming the README and changelog. It works like this for languages too, at least for me. My first "real" language (aside from QBasic) was C++ and it took me 3-4 years to learn it t…
But it does, you're just focusing on the other component of learning. Put another way, for a new tool, learning cost is a sum of a) cost of learning idiosyncrasies of that tool, and b) cost of getting familiar with the concepts used by it. You're talking about b), which is indeed a shared expense. But a), by definition, isn't. And it's always nonzero. And since new tools are usually made to differ from previous ones…
As an example, imagine you're learning Underscore.js for the first time. It's a mind-blowing experience, which takes a lot of time because you have to learn a bunch crazy concepts, like currying, partial application, binding, and others. You also have to learn Underscore-specific idiosyncrasies, like the order of arguments passed to the callback functions and the like - mostly because you are not yet aware which things are important to know and which are just idiosyncrasies.
Now, imagine you know Underscore already and have to learn Lo-dash or Ramda.js. As the concepts remain very similar, you only need to learn a few conventions, which are different in Ramda. But! Even then, you don't have to really learn all of them to use the library effectively. It's enough to keep the diff of the Underscore and Ramda conventions in mind: learning that, for example, the order of arguments passed to callbacks differ is enough; you can then check the correct order in the docs whenever you need. You know where to find that piece of information, you know when it matters and, by extension, when it's not a concern. There is no need to waste time trying to learn trivia: not doing something is always going to be the fastest way of doing it. By your second library, you start to recognize trivia and are able to separate it from informations that matter. Learning prelude.ls afterward is going to take literally 30 minutes of skimming the docs.
This is just an example, but it worked like that for me in many cases. When I switched from SVN to Bazaar, for example, it took quite a bit of time to grok the whole "distributed" thing. When I later switched from Bazaar to Git it took me literally an hour to get up to speed with it, followed by a couple more hours - spaced throughout a week or two - of reading about the more advanced features. Picking up Mercurial after that was more or less automatic.
I guess all of this hinges upon the notion of the level of familiarity. While I was able to use bzr, git and hg, it only took so little time because I consciously chose to ignore their intricacies, which I knew I won't need (or won't need straight away). On the other hand, you can spend months learning a tool if your goal is a total mastery and contributing to its code. But the latter is very rarely something you'd be required to do, most of the time the level of basic proficiency is more than enough. In my experience, the cost of reaching such a level of proficiency becomes smaller as you learn more tools of a particular kind.
That's the reason I disagree with your remark that that cost is "constant". It's not, it's entirely dependent on a person and the knowledge they accumulated so far. Learning Flask may take you a week if you're new to web development in Python, but you could learn it in a single evening if you worked with Bottle already. On a higher level, learning Elixir may take you months, but you could also accomplish it in a week, provided that you already knew Erlang and Scheme well.
So that's it - the cost of learning new tools may be both prohibitive and trivial at the same time, depending on a prior knowledge of a learner. The good thing about the "prior knowledge and experience" is that it keeps growing over time. The amount of knowledge you'll have accumulated in 20 years is going to be vast to the extent that's hard to imagine today. At that point, the probability of any tool being genuinely new to you will hit rock bottom and the average cost of switching to another tool should also become negligible.
To summarize: I believe that learning new tools gets easier and easier with time and experience and - while never really reaching 0 - at some point, the cost becomes so low that it doesn't matter anymore (unless you have to switch really often, of course).
Re: Many packages suddenly disappeared
#468Earlier quoted context omitted.
You're in a really self-selecting crowd then. Less than half the people I know use it, mostly because my social group is outside of the tech world.
Reddit is in the top 10 most popular websites according to Alexa. I'd venture to say most reddit users aren't people in the tech world.
Re: Many packages suddenly disappeared
#469Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?
Re: Many packages suddenly disappeared
#470Btw. for those who don't know: Yarn (which is an alternative to npm) uses a global cache [1] on your machine which speeds things up, but probably also protects you from immediate problems in cases like the one currently on progress (because you would probably have a local copy of e.g. require-from-string available). [1] https://yarnpkg.com/lang/en/docs/cli/cache/
Already counting down the days before yarn is considered old and broken and people are recommending switching to the next hot package manager/bundler...