Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

501–510 of 520 posts

Re: Many packages suddenly disappeared

#501

Post by not_kurt_godel »

zbentley wrote: post #493
not_kurt_godel wrote: post #422

Earlier quoted context omitted.

virtualenv makes it trivial. It's not like it's strictly enterprise-grade tech.

How does vrtualenv make maintaining, auditing, and using a local mirror of dependencies trivial? Seems to me I can download a poisoned package into a venv cache just as easily as I can download it with wget, and unless I take the time to check, I’m none the wiser either way.

I was referring specifically to not being able to deploy due to a package manager being down. Of course there are still issues that can crop up with using virtualenv.

Re: Many packages suddenly disappeared

#502

Post by abritinthebay »

greenleafjacob wrote: post #367
abritinthebay wrote: post #360

Earlier quoted context omitted.

No JS framework does that because they version things. Run the same versions and it works. If you’re not pinning versions correctly that’s hardly JS’s fault.

This is a cultural thing, where developers will decide when to invest in developing their library against the old version and when for the new version. For stable languages like C, or distro supported packages it’s years - just check out Debian or Red Hat for an ecosystem that values stability.

Sure, and at the scale & purpose of Debian or Red Hat that’s extremely important.

But that’s nothing to do with bad versioning practices and everything to do with product priorities.

Also C versions are have the same issue. Try to build a C11 project with a C89 compiler. Hell I’ve had C89 code not work in clang...

Versions affect everything.

Re: Many packages suddenly disappeared

#503

Post by abritinthebay »

kevingadd wrote: post #435
abritinthebay wrote: post #355

Earlier quoted context omitted.

I’m impressed. Not one thing you just said is accurate.

I'm impressed, because everything they said is accurate.

I know HN is basically an industry wide joke for JS discussion but no, none of that is accurate.

Most of it is plain wrong, though some of it is misapplied frustration to the wrong target.

But again, I guess I shouldn’t expect more from HN.

Re: Many packages suddenly disappeared

#504

Post by megaman22 »

abritinthebay wrote: post #503
kevingadd wrote: post #435

Earlier quoted context omitted.

I'm impressed, because everything they said is accurate.

I know HN is basically an industry wide joke for JS discussion but no, none of that is accurate. Most of it is plain wrong, though some of it is misapplied frustration to the wrong target. But again, I guess I shouldn’t expect more from HN.

What exactly is wrong?

Re: Many packages suddenly disappeared

#505

Post by Moru »

Momquist wrote: post #497
ragesh wrote: post #464

Earlier quoted context omitted.

Genuine question... What happened with the microwave oven?

I think the GP is refering to this: https://news.ycombinator.com/item?id=16089865 Modern microwave ovens have all adopted impractical and quirky new UIs, when the old concept of knobs was simple and worked fairly well in the first place.

My oldest one was just two dials, the second one, 15 years old had loads of buttons and stuff, really stupidly spread out, you had to press watt, minutes, seconds, start and start was not in a corner, not in top/bottom row or any other logical place so you had to search it every time. I glued a rubber piece to it so I could find it again without having to bend down and search.

Since then I have made sure the microwave has two dials, one for time, one for effect.

Re: Many packages suddenly disappeared

#506

Post by vorg »

klibertp wrote: post #491
vorg wrote: post #481

Earlier quoted context omitted.

> Last week I learned Groovy in about 4 hours How well did you "learn" Apache Groovy? Just enough to change a small Gradle build file? And did you already know any Java beforehand? If so, then there's a lot less Groovy that needs learning. Did you write enough Groovy code to stumble across some of its many gotchas, or did you skim some docs and just learn what Groovy should be?

> How well did you "learn" Apache Groovy? I'm not sure. I did it because of Jenkins Pipeline DSL; I learned enough to write ~400 loc of a build script from scratch. I was able to de-sugar the DSL and wrap raw APIs with a DSL of my own design (I'd say that I "wrote a couple of helper functions", but the former sounds way cooler...). I did stumble upon some gotchas - the difference between `def` and simple assignment w…

> the scare quotes around "learn"? I feel that putting the quotes there is rather impolite

When I say I've learned (or learnt) a programming language, I mean more than a 4-hour jump start to basic proficiency level. Perhaps I was letting off some steam over the wild claims many programmers make regarding their PL expertise.

Did you know that Jenkins Pipeline cripples Groovy so all its features aren't available, specifically the Collections-based methods that form the basis of many DSL's?

Re: Many packages suddenly disappeared

#508

Post by thanatropism »

jpalomaki wrote: post #479
didibus wrote: post #395

Earlier quoted context omitted.

I'd be surprised if they ran a thorough security audit on all code they import, but I'd rather believe they do.

On Google scale you quite certainly want to do that. Not just for security, but for legal reasons. You really don't want to end up using for example AGPL licensed stuff in wrong places and if you just blindly pull stuff with dependencies from package manager, this could easily happen.

One of the recent True Geordie podcasts features the "YouPorn Guy" who talks about finding it near impossible to get lawyers not on a retainer from Google to fight them.

Re: Many packages suddenly disappeared

#509

Post by aabbcc1241 »

the_duke wrote: post #134
vitaliyf wrote: post #25

Earlier quoted context omitted.

You run a private NPM mirror where you copy dependencies that you rely on, after auditing them (for code quality and licensing).

Easiest solution without infrastructure imo is to vendor node_modules as a git submodule. (Of course it's even easier to just add node_modules to the repo but that is messy).

and you better fork the git repo, otherwise the incident happening to npm can happen on github / whatever remote repo.

Re: Many packages suddenly disappeared

#510

Post by seldo »

seldo wrote: post #268

Hi folks, npm COO here. This was an operational issue that we worked to correct. All packages are now restored: https://status.npmjs.org/incidents/41zfb8qpvrdj

Update: (this is not the post-mortem, this is just more detail) http://blog.npmjs.org/post/169432444640/npm-operational-inci...
Post reply on HN