Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

511–520 of 520 posts

Re: Many packages suddenly disappeared

#511

Post by klibertp »

vorg wrote: post #506
klibertp wrote: post #491

Earlier quoted context omitted.

> How well did you "learn" Apache Groovy? I'm not sure. I did it because of Jenkins Pipeline DSL; I learned enough to write ~400 loc of a build script from scratch. I was able to de-sugar the DSL and wrap raw APIs with a DSL of my own design (I'd say that I "wrote a couple of helper functions", but the former sounds way cooler...). I did stumble upon some gotchas - the difference between `def` and simple assignment w…

> the scare quotes around "learn"? I feel that putting the quotes there is rather impolite When I say I've learned (or learnt ) a programming language, I mean more than a 4-hour jump start to basic proficiency level. Perhaps I was letting off some steam over the wild claims many programmers make regarding their PL expertise. Did you know that Jenkins Pipeline cripples Groovy so all its features aren't available, spec…

> Did you know that Jenkins Pipeline cripples Groovy

Yes. I've run into some limitations; first because of a Pipeline DSL, and when I ditched it in favor of normal scripting I ran into further problems, like Jenkins disallowing the use of isinstance (due to a global configuration of permissions, apparently - I don't have administrative rights there) and many other parts of the language. It was kind of a pain, actually, because I developed my script locally - mostly inside groovysh - where it all worked beautifully and it mysteriously stopped working once uploaded. A frustrating experience, to say the least.

> over the wild claims many programmers make regarding their PL expertise.

I believe I'm a bit of a special case[1] here, wouldn't you agree? Many of the languages on that list I only learned about, however, many of them I learned, having written several thousand (on the low end) of lines of code in them. It's got to be at least 30, I think? I'd need to count.

Anyway, I argue that such an accumulation causes a qualitative difference in how you learn new languages, allowing for rapid acquisition of further ones. It's like in role-playing games, if you buff your stats high enough you start getting all kinds of bonuses not available otherwise :)

[1] If I'm not and you know of someone with the same hobby, please let me know! I'd be thrilled to talk to such a person!

Re: Many packages suddenly disappeared

#512

Post by YouKnowBetter »

Moru wrote: post #505
Momquist wrote: post #497

Earlier quoted context omitted.

I think the GP is refering to this: https://news.ycombinator.com/item?id=16089865 Modern microwave ovens have all adopted impractical and quirky new UIs, when the old concept of knobs was simple and worked fairly well in the first place.

My oldest one was just two dials, the second one, 15 years old had loads of buttons and stuff, really stupidly spread out, you had to press watt, minutes, seconds, start and start was not in a corner, not in top/bottom row or any other logical place so you had to search it every time. I glued a rubber piece to it so I could find it again without having to bend down and search. Since then I have made sure the microwav…

Remember the watercooker that had just an on & off switch?

Then came one with an option button for 80 or 100 degrees (176 or 212, in freedoms). Never knew I needed that, but that just changed my live and I can not do without it. Reason: 80 degrees water is hot enough for my needs and saves time.

Our latest has 3 buttons, with different possiblities, beebs like a maniac when ready (an option which is not unset-able) and can do things I never knew anyone would need (like keeping it at x degrees for y minutes).

I guess it is like evolution: you experiment, keep what works and get rid of all things unfit.

Re: Many packages suddenly disappeared

#513

Post by corpMaverick »

DougWebb wrote: post #229
sergiotapia wrote: post #9

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards? I think the (short) answer is "node, npm, and javascript". The longer answer has something to do with the automatic installation of dependencies, and the common use of shell scripts downloaded directly off the internet and executed using the developer's or sysadmin's user account. I used to use CPAN all the time. CPAN would check de…

Also. In CPAN there was a culture of having comprehensive unit tests. If something broke, you would likely see it at installation.

Re: Many packages suddenly disappeared

#514

Post by vorg »

klibertp wrote: post #511
vorg wrote: post #506

Earlier quoted context omitted.

> the scare quotes around "learn"? I feel that putting the quotes there is rather impolite When I say I've learned (or learnt ) a programming language, I mean more than a 4-hour jump start to basic proficiency level. Perhaps I was letting off some steam over the wild claims many programmers make regarding their PL expertise. Did you know that Jenkins Pipeline cripples Groovy so all its features aren't available, spec…

> Did you know that Jenkins Pipeline cripples Groovy Yes. I've run into some limitations; first because of a Pipeline DSL, and when I ditched it in favor of normal scripting I ran into further problems, like Jenkins disallowing the use of isinstance (due to a global configuration of permissions, apparently - I don't have administrative rights there) and many other parts of the language. It was kind of a pain, actuall…

Yes, I agree. I changed my outlook on programming after I spent about 2 years playing with Clojure as a hobby, then 1 year on Haskell.

Re: Many packages suddenly disappeared

#515

Post by caryhartline »

tzs wrote: post #450
shawn wrote: post #15

So, funny story: I registered the "nazi" npm package. When you require it, it says "I did nazi that coming." That's it. (Though it would've been a funny name for a linter.) ... Or it did. I received a harshly worded letter from npm saying they axed it. It hit all the talking points about inclusiveness and making sure no one feels even slightly annoyed. Meh. No point to this story. Just an interesting situation with a…

Try a package named Nazí, which provides a collection of the chess games of 2016 US Women's Chess Champion Nazí Paikidze [1]. At the same time also do one named Fabiano, which provides a collection of the games of Fabiano Caruana [2], the 2016 US Chess Champion. If they take that down the Nazí one but not the Fabiano one, you can then take your mischief making to the next level by accusing them of being misogynists f…

This isn't the Supreme Court. They don't need to be consistent and they are going to see past the pointless trolling.

Re: Many packages suddenly disappeared

#516

Post by tetha »

eropple wrote: post #427
didibus wrote: post #394

Earlier quoted context omitted.

What if it encrypts user data?

You have your tested backups, yeah?

Tested restores with at most 59 minutes of data loss for prod clusters within 90 minutes after order. 30ish minutes of downtime. We could even inspect binlogs for a full restore afterwards on a per-request basis for our big customers.

Cryptolocker on prod is not my primary issue.

Re: Many packages suddenly disappeared

#517

Post by styfle »

0x0 wrote: post #309
naasking wrote: post #298

Earlier quoted context omitted.

Signing won't help unless the end user specifies the signature or certificate that they expect (signing would only help ensure package upgrades are from the same author). If you're going to have clients specify a signature anyway, then you don't need to sign packages, you just need strong one way hash function, like SHA-1024 or something. User executes "pkg-mgr install [package name] ae36f862..." Either way, every tu…

"npm install packagename" could record the public key in package.json (or package-lock.json) on first save, and only accept installs (or upgrades) matching the same public key. Just like how android app code signing works, or similar to ssh known_hosts trust-on-first-use. Granted it wouldn't save those adding a new package to a project the first time, but it would save the bacon of anyone re-running "npm install" in…

Would that mean a package with multiple authors would have to shared the private key with each other in order to publish a new version?

Re: Many packages suddenly disappeared

#518

Post by Can_Not »

tonyarkles wrote: post #414
dadvader wrote: post #375

Earlier quoted context omitted.

> it's held back by all the gymnastics it needs to do to get over browser/www limitations, I suppose, but I think it's the javascript "nature" ( dynamic typing along with the scripting style of wanting to be a "swiss knife" to solve all problems ). Javascript, like perl and even C, gives you a lot of rope to hang yourself. And like perl and C, javascript initially seems simple and easy and it deceives you into thinki…

> Plenty of incompetent developers at all levels and all languages. I don't think it's a javascript issue. While that's potentially true, I do suspect that there's a lot fewer, say, Haskell, Clojure, or Elixir developers than there are for some other languages. Not that they don't exist, but it seems unlikely that you'd cross paths with them.

There's orders of magnitudes less developers and jobs available for those languages. I'm only not an elixir developer because there's almost zero elixir jobs.

Re: Many packages suddenly disappeared

#519

Post by chrisfosterelli »

fl00d wrote: post #485
seldo wrote: post #292

Earlier quoted context omitted.

We're working on a full post-mortem now. Until then we don't want to give out misleading/partial information.

Any update on the post-mortem? How long have the binaries been replaced? Is there evidence that malware was injected into the binaries? Additionally, you should brush up on your code signing implementations. Had you signed it with a trusted code signing cert, consumers could have verified that you produced the binaries...and not a malicious user. Assuming they didnt have access to the private key material of your cod…

Not sure if you saw but they did post this: http://blog.npmjs.org/post/169432444640/npm-operational-inci...

Re: Many packages suddenly disappeared

#520

Post by styfle »

mjrpes wrote: post #388

I don't use NPM (or community managed package managers in general), but anyone know why there isn't an LTS feature with packages? So that, when searching packages, if a package is flagged as LTS, you know that it and all its dependencies have long term support and there are contingencies on what happens if the package is abandoned. Obviously, there would need to be a community that reviews and approves packages that…

There are unofficial stability badges[0] that I have seen some packages use. For example, xtend[1] is locked.

[0]: https://github.com/badges/stability-badges

[1]: https://www.npmjs.com/package/xtend

Post reply on HN