Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not use NPM 5.7

github.com

Post reply on HN
Print view View original

11–20 of 233 posts

Re: Do not use NPM 5.7

#11

Post by progval »

Silhouette wrote: post #7
mkj wrote: post #6

Reminds me of a recent Yarn problem, overwriting which(1). https://github.com/yarnpkg/yarn/issues/4205

Both of these issues seem like a timely reminder that everyday Linux desperately needs a proper application management and security model. Installing software where your options are 1. running as a regular user, and the install script can put whatever it wants within your user's directories or 2. running as root, and the install script can do literally anything to anywhere on your system is not fit for purpose, when…

> everyday Linux desperately needs a proper application management and security model.

We already have the necessary tools to do it, eg. firejail. We only have to make every binary run in firejail by default (and write firejail profiles for more binaries).

Re: Do not use NPM 5.7

#12

Post by dictum »

Oh well, I remember fondly that one time I had an important deadline whooshing by (with that lovely sound Douglas Adams knew) and I happened across this cute little bug:

http://appleinsider.com/articles/09/10/12/snow_leopard_guest...

(Yeah, it's that much-vaunted Snow Leopard.)

I do remember scrambling to recover my backups. Back then, I didn't make full-disk backups, so I had to assemble my user folder from various places. Everything else that transpired that night and the day after remains a haze.

Re: Do not use NPM 5.7

#13

Post by seba_dos1 »

obw wrote: post #2

I find it interesting that nobody noticed this before public release. And apparently this version is a pre-release? But that isn't specified on the blog post?

What's more, while "npm install -g npm" correctly installs 5.6.0, "npm update -g npm" installs this apparently pre-release 5.7.0 version.

Re: Do not use NPM 5.7

#14

Post by mastax »

Silhouette wrote: post #7
mkj wrote: post #6

Reminds me of a recent Yarn problem, overwriting which(1). https://github.com/yarnpkg/yarn/issues/4205

Both of these issues seem like a timely reminder that everyday Linux desperately needs a proper application management and security model. Installing software where your options are 1. running as a regular user, and the install script can put whatever it wants within your user's directories or 2. running as root, and the install script can do literally anything to anywhere on your system is not fit for purpose, when…

Yeah people like to hate on Microsoft/Mac App Stores, but at least they don't let programs vomit files across the disk.

The Linux solution I suppose is Nix/Guix or Flatpak/Snap or Docker a la RancherOS. Perhaps more restrictive SELinix profiles could work as well.

Re: Do not use NPM 5.7

#15

Post by ishanjain28 »

npm is one of the few tools that I am afraid to have on my Laptop, Because unlike most tools I have used, When npm does something wrong, It'll ruin not just itself but a lot more directories on my pc which is annoying to fix.

Re: Do not use NPM 5.7

#16

Post by btown »

grahamj wrote: post #8
btown wrote: post #5

There appear to be no unit tests for their entire lib/utils folder. Which includes things like this (misguided) chown utility. https://github.com/npm/npm/tree/release-next/test - and note the lack of testing in the commit linked in the bug report. I had an inkling that NPM was cancer, but not like this. Yarn, by contrast, has everything you would expect of a Facebook-engineered library: https://github.com/yarnpkg/yar…

"everything you would expect of a Facebook-engineered library" So it collects your personal information, even when not using it, and uses it for profit?

At the risk of troll-engaging: there's a huge difference between using an independently-auditable, multiple-contributing-entity, open-source library that happens to have been originated by a social network's engineering team, and using the identity-tracking public APIs of a closed social network. And both can be useful in certain situations. Be wary, but don't close oneself off to good technology just because it's associated with technology you disapprove of.

Re: Do not use NPM 5.7

#17

Post by vetinari »

Silhouette wrote: post #7
mkj wrote: post #6

Reminds me of a recent Yarn problem, overwriting which(1). https://github.com/yarnpkg/yarn/issues/4205

Both of these issues seem like a timely reminder that everyday Linux desperately needs a proper application management and security model. Installing software where your options are 1. running as a regular user, and the install script can put whatever it wants within your user's directories or 2. running as root, and the install script can do literally anything to anywhere on your system is not fit for purpose, when…

> everyday Linux desperately needs a proper application management

You mean something, that won't allow two packages to own the same file? Something, like, rpm or apt?

Re: Do not use NPM 5.7

#20

Post by reificator »

zaarn wrote: post #3

Excuse me, but what the fuck? Looks like the line responsible checks if the npm binary is run as sudo and then uses the UID and GID of the invoking user when chowning the directory. [ https://github.com/npm/npm/blob/latest/lib/utils/correct-mkd... ] I feel like screaming, who thought this was a good idea? If I invoke something as sudo, why does anyone think it should try to detect that and do anything about it? I wan…

I completely agree with you.

But in fairness, I can't count the number of times that I've needed to fix things after people treated `sudo npm` as Simon Says[1].

I'm sure they struggled a lot with that issue before coming to this solution. Was it the right solution? Absolutely not. But that's not the point I'm trying to make.

It's all too easy to tunnel vision on a particular solution. I've done it plenty of times, and I'm thankful to those who have helped me to see other alternatives in time.

[1]: https://xkcd.com/149/

Post reply on HN