Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

481–490 of 520 posts

Re: Many packages suddenly disappeared

#481

Post by vorg »

klibertp wrote: post #457
TeMPOraL wrote: post #111

Earlier quoted context omitted.

Because each thing has a constant price in learning effort that is familiarizing yourself with its idiosyncrasies, which you have to pay even if you're experienced in the domain. When tools constantly get replaced instead of improved, you keep paying that price all the time.

> Because each thing has a constant price in learning effort That's not, in my experience, how it works. Learning your first tool (or language) takes a lot of time. Learning your second is quicker. By the tenth, you're able to learn it by skimming the README and changelog. It works like this for languages too, at least for me. My first "real" language (aside from QBasic) was C++ and it took me 3-4 years to learn it t…

> Last week I learned Groovy in about 4 hours

How well did you "learn" Apache Groovy? Just enough to change a small Gradle build file?

And did you already know any Java beforehand? If so, then there's a lot less Groovy that needs learning.

Did you write enough Groovy code to stumble across some of its many gotchas, or did you skim some docs and just learn what Groovy should be?

Re: Many packages suddenly disappeared

#484

Post by tonyarkles »

klibertp wrote: post #452
tonyarkles wrote: post #430

Earlier quoted context omitted.

Just realized I meant to say "a lot fewer, say, incompetent ..."

Well, both versions are true, the latter mostly following from the former. With a lower absolute number of developers, the number of incompetent programmers is going to be lower in absolute terms, despite the ratio staying the same as in other languages. But I believe there's a difference in the ratio, too, due to the way Haskell, Erlang, Lisp, etc. programmers learn these languages. Basically, they learn the languag…

Totally agree!

I think it somewhat comes back to the "Python Paradox": http://www.paulgraham.com/pypar.html

Another part of it is that someone who's incompetent in, e.g. JavaScript, is likely to not make it very far trying to do Clojure. And, again some conjecture, I'd bet that someone who is great at Clojure would write very nice JS.

When I was learning Python back in, 2006 or so, I remember someone stating "You can write Java in any language". This was referring to people who wrote Python code with these huge class hierarchies that inherited from stuff all over the place, when a "Pythonic" solution would have just involved a couple of functions.

Re: Many packages suddenly disappeared

#485

Post by fl00d »

seldo wrote: post #292
chrisfosterelli wrote: post #274

Earlier quoted context omitted.

Yes I'd be very curious to see a debrief on what the technical cause was. Thanks to the npm team for a quick weekend fix, at any rate!

We're working on a full post-mortem now. Until then we don't want to give out misleading/partial information.

Any update on the post-mortem? How long have the binaries been replaced? Is there evidence that malware was injected into the binaries?

Additionally, you should brush up on your code signing implementations. Had you signed it with a trusted code signing cert, consumers could have verified that you produced the binaries...and not a malicious user. Assuming they didnt have access to the private key material of your code signing key.

Re: Many packages suddenly disappeared

#486

Post by CaptSpify »

zbentley wrote: post #476
CaptSpify wrote: post #449

Earlier quoted context omitted.

And? Most of these are things you absolutely should be thinking about

"You should be thinking about" and "You need this? Seriously?" are very different statements. Of course you should be aware of dependencies.

And you should also be aware of what it takes to rebuild your stack, and have something in place if that disappears. If you think it's OK to rely on external tools like that to build your system, you deserve all the fallout you get when it fails.

Re: Many packages suddenly disappeared

#487

Post by gkya »

zapt02 wrote: post #373
gkya wrote: post #299

Earlier quoted context omitted.

Well, kind of. Node was not a general purpose tool as conceived initially. You would write some I/O bound servers in it. And PHP too is not a general purpose tool, it is for writing interactive web pages (in its pre-Web2.0 sense) easily. Though Node.js was way more intellectually designed. I don't know much about PHP, but there's lots of literature (see https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ ).

I wonder when people will stop quoting this 4+ year old article. Most of what are actually issues are long fixed. https://php.vrana.cz/php-a-fractal-of-not-so-bad-design.php

When it's invalid, maybe. The article you link says in the first three paragraphs:

---8Whether you like PHP or not, go and read the article PHP: a fractal of bad design. It's well written by someone who really knows the language which is not true for most other articles about this topic. And there are numerous facts why PHP is badly designed on many levels. There is almost no FUD so it is also a great source for someone who wants to learn PHP really well (which is kind of sad).

I am surprised that I am able to live with PHP and even like it. Maybe I am badly designed too so that I am compatible with PHP. I was able to circumvent or mitigate most problems so the language doesn't bother me.

Anyway, there are several topics which are inaccurate or I don't agree with them. Here they are with no context so they probably wouldn't make much sense without reading the original article:

Re: Many packages suddenly disappeared

#488

Post by mamcx »

sergiotapia wrote: post #9

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

I wonder how much damage need to be done with JS/Node until seriously is put to rest the madness. Is absolutely necessary to break backward compatibility and rebuild JS from the start. With WebAssembly this is doable (without excuses!) and we already have a nice tag to declare what script language to use.

This is not possible, you ask?

In fact, JS/CSS is the most viable of all the stacks to move forward. Let's use the "advantage" that any JS library/ecosystem die fast and put enough hipster propaganda declaring the ultimate solution.

Is too hard? JS is so bad that fix it is too easy. You only need more than the week it originally take to build it.

Re: Many packages suddenly disappeared

#489

Post by adjkant »

TimothyBJacobs wrote: post #433
adjkant wrote: post #431

Earlier quoted context omitted.

You're in a really self-selecting crowd then. Less than half the people I know use it, mostly because my social group is outside of the tech world.

Reddit is in the top 10 most popular websites according to Alexa. I'd venture to say most reddit users aren't people in the tech world.

Perhaps not all tech, but my point is that it's very unused by many. People in tech are far more common users.

Re: Many packages suddenly disappeared

#490

Post by uallo »

Here is the official response from npm:

http://blog.npmjs.org/post/169432444640/npm-operational-inci...

TL;DR: "no malicious actors were involved in yesterday’s incident, and the security of npm users’ accounts and the integrity of these 106 packages were never jeopardized."

A more detailed report will follow in the next days.

Post reply on HN