Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

491–500 of 520 posts

Re: Many packages suddenly disappeared

#491

Post by klibertp »

vorg wrote: post #481
klibertp wrote: post #457

Earlier quoted context omitted.

> Because each thing has a constant price in learning effort That's not, in my experience, how it works. Learning your first tool (or language) takes a lot of time. Learning your second is quicker. By the tenth, you're able to learn it by skimming the README and changelog. It works like this for languages too, at least for me. My first "real" language (aside from QBasic) was C++ and it took me 3-4 years to learn it t…

> Last week I learned Groovy in about 4 hours How well did you "learn" Apache Groovy? Just enough to change a small Gradle build file? And did you already know any Java beforehand? If so, then there's a lot less Groovy that needs learning. Did you write enough Groovy code to stumble across some of its many gotchas, or did you skim some docs and just learn what Groovy should be?

> How well did you "learn" Apache Groovy?

I'm not sure. I did it because of Jenkins Pipeline DSL; I learned enough to write ~400 loc of a build script from scratch. I was able to de-sugar the DSL and wrap raw APIs with a DSL of my own design (I'd say that I "wrote a couple of helper functions", but the former sounds way cooler...). I did stumble upon some gotchas - the difference between `def` and simple assignment when the target changes, for example.

EDIT: I wonder, is that level of proficiency enough for you to at least drop the scare quotes around "learn"? I feel that putting the quotes there is rather impolite.

> did you skim some docs and just learn what Groovy should be?

As I elaborate on in the comment below, there are different levels of proficiency and I never claimed mastery - just a basic proficiency allowing me to read all of the language constructs and write, as mentioned, a simple script from scratch, with the help of the docs.

> And did you already know any Java beforehand?

Well, a bit, although I didn't work with it professionaly in the last decade. However, knowing Java wouldn't be enough to make learning Groovy that fast - I have another trump card up my sleeve when it comes to learning programming languages. You might be interested in a section of my blog here: https://klibert.pl/articles/programming_langs.html if you want to know what it is. To summarize: I simply did it more than 100 times already.

Re: Many packages suddenly disappeared

#492

Post by mohsen1 »

uallo wrote: post #490

Here is the official response from npm: http://blog.npmjs.org/post/169432444640/npm-operational-inci... TL;DR: "no malicious actors were involved in yesterday’s incident, and the security of npm users’ accounts and the integrity of these 106 packages were never jeopardized." A more detailed report will follow in the next days.

They are claiming issue is resolved while I'm still not seeing a package my package is depending on

https://github.com/mohsen1/json-formatter-js/pull/58#issueco...

Re: Many packages suddenly disappeared

#493

Post by zbentley »

not_kurt_godel wrote: post #422
zbentley wrote: post #368

Earlier quoted context omitted.

That's a good goal to strive for, but isn't necessary or practical for everyone. Maintaining local/hosted artifact caches, verifying them, and auditing them is a big hassle, and unless you make something (e.g. fintech, healthtech) that might need such an audit or emergency release, might not be worth the trouble. Itty bitty company making a social website on a shoestring budget/runway with very few developers? Might…

virtualenv makes it trivial. It's not like it's strictly enterprise-grade tech.

How does vrtualenv make maintaining, auditing, and using a local mirror of dependencies trivial? Seems to me I can download a poisoned package into a venv cache just as easily as I can download it with wget, and unless I take the time to check, I’m none the wiser either way.

Re: Many packages suddenly disappeared

#494

Post by msoad »

Why Node.js comes with a client for a for profit company is still baffling me. NPM team has proven time and time again they are not competent enough to handle this responsibility yet they are given the free ride by the Node.js foundation.

Node.js package manager SHOULD BE COMMUNITY OWNED/DRIVEN

Re: Many packages suddenly disappeared

#495

Post by lillesvin »

zkomp wrote: post #439
lillesvin wrote: post #362

Earlier quoted context omitted.

I really wish that people would stop referencing that "Fractal of Bad Design" article. It's outdated and mostly irrelevant now (April 2012, PHP was at 5.4 then, it's at 7.2 now). It's not that I want to defend PHP, I just think people should judge PHP for what it is now instead of what it was several major changes ago. Besides, the author seems to misunderstand a great many things about PHP and languages in general.…

Hmm are you sure? I've read the fractal of bad design many times. Some issues might be "fixed" but could they fix the actual *fractal of bad design"? Isn't it still a mix of c-style, java-style, inconcistent, left associative, horribly broken language it always was? I always thought the bugs were anecdotal backing of the main point: php is badly designed, non programming language for non programmers, who suffer stock…

> Hmm are you sure? I've read the fractal of bad design many times.

Yeah, I'm sure. And so have I. Maybe you should stop reading it to reinforce your prejudice and instead take a look at PHP 7.2?

> non programming language for non programmers, who suffer stockholm syndrome from all php abuse...

Hating PHP is almost like a bad meme. Obviously it's doing something right otherwise it probably wouldn't be as popular as it is. (Same can be said for Javascript, I guess.)

Your personal feelings about the language are pretty much irrelevant. The Fractal of Bad Design article, however, is actually spreading misinformation yet people with an axe to grind keep referencing it because it fits their agenda, hence why I react whenever I see it referenced.

Here are just a couple of examples of where it's flat out wrong and/or completely outdated. There are plenty more.

He's left in things that were fixed long before he published the article — e.g. the new array syntax — but that doesn't stop him from saying stuff like "Despite that this is the language’s only data structure, there is no shortcut syntax for it; array(...) is shortcut syntax. (PHP 5.4 is bringing “literals”, [...].)" Keep in mind, 5.4 was already out when he wrote it...

Not to mention the whole section on "missing features" where he basically enumerates things that most certainly doesn't belong in a language's core but in separate libraries or part of a framework, and — surprise! — those are all available in both libraries, frameworks, extensions, etc.

"There is no threading support whatsoever." pthreads have been stable since 2013: http://pecl.php.net/package/pthreads

Re: Many packages suddenly disappeared

#496

Post by no29 »

naasking wrote: post #471
0x0 wrote: post #309

Earlier quoted context omitted.

"npm install packagename" could record the public key in package.json (or package-lock.json) on first save, and only accept installs (or upgrades) matching the same public key. Just like how android app code signing works, or similar to ssh known_hosts trust-on-first-use. Granted it wouldn't save those adding a new package to a project the first time, but it would save the bacon of anyone re-running "npm install" in…

> Granted it wouldn't save those adding a new package to a project the first time Right, that's the real problem.

independent site that maps packages to author certs that npm uses for verification at install time?

also, this is a problem that every package mgmt system faces. they alert on changes on upgrade but there's a requirement at the end user level to verify that at install time, the cert being trusted is the right one.

Re: Many packages suddenly disappeared

#497

Post by Momquist »

ragesh wrote: post #464
Moru wrote: post #462

Earlier quoted context omitted.

This happens all the time. The new generation creates something cool because what our parents created isnt cool any more, only to fail exactly on the same spot as our parents. Only, it was already solved in the parents last version. This goes for cloth design, cars, houses, kitchen wares and so on, as well as software. Just look at the microwave oven earlier...

Genuine question... What happened with the microwave oven?

I think the GP is refering to this: https://news.ycombinator.com/item?id=16089865

Modern microwave ovens have all adopted impractical and quirky new UIs, when the old concept of knobs was simple and worked fairly well in the first place.

Re: Many packages suddenly disappeared

#498

Post by TheKarateKid »

TimothyBJacobs wrote: post #433
adjkant wrote: post #431

Earlier quoted context omitted.

You're in a really self-selecting crowd then. Less than half the people I know use it, mostly because my social group is outside of the tech world.

Reddit is in the top 10 most popular websites according to Alexa. I'd venture to say most reddit users aren't people in the tech world.

There's a difference between people who come across or read Reddit, and those who actually post and participate on Reddit. The Average Joe is usually part of the former.

Re: Many packages suddenly disappeared

#499

Post by uallo »

mohsen1 wrote: post #492
uallo wrote: post #490

Here is the official response from npm: http://blog.npmjs.org/post/169432444640/npm-operational-inci... TL;DR: "no malicious actors were involved in yesterday’s incident, and the security of npm users’ accounts and the integrity of these 106 packages were never jeopardized." A more detailed report will follow in the next days.

They are claiming issue is resolved while I'm still not seeing a package my package is depending on https://github.com/mohsen1/json-formatter-js/pull/58#issueco...

I've never used pinkie before. But according to its GitHub page, there is no version 2.0.5:

https://github.com/floatdrop/pinkie

It seems that someone took over the package during its absence from npm and deployed a version 2.0.5. Maybe to avoid any malicious takeover. But there is no version 2.0.5 anymore.

Re: Many packages suddenly disappeared

#500

Post by BeeOnRope »

jpalomaki wrote: post #479
didibus wrote: post #395

Earlier quoted context omitted.

I'd be surprised if they ran a thorough security audit on all code they import, but I'd rather believe they do.

On Google scale you quite certainly want to do that. Not just for security, but for legal reasons. You really don't want to end up using for example AGPL licensed stuff in wrong places and if you just blindly pull stuff with dependencies from package manager, this could easily happen.

Sure a legal audit is standard and usually much simpler than a full source audit for security, which has a complexity proportional to the project size.
Post reply on HN