Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not use NPM 5.7

github.com

Post reply on HN
Print view View original

31–40 of 233 posts

Re: Do not use NPM 5.7

#31

Post by tbranyen »

foepys wrote: post #24

Apart from being a horrific bug, why are people running npm as root? Why don't they install it somewhere below $HOME and modify $PATH? npm is working fine without root permissions. Everything is super dangerous as root, one should avoid using root at all costs until there is no other way.

Because sometimes you are writing software that interacts with hardware at a root level. This is really annoying advice you're giving since its absolute and without context. No, not everything is "super dangerous" with sudo. Get that FUD outta here!

Re: Do not use NPM 5.7

#32

Post by zdragnar »

jergason wrote: post #22
lucideer wrote: post #4

This is really horrific. The idea that correctMkdir() exists at all seems to me to be so wrong-headed. This comment from the source says a lot: // annoying humans and their expectations! Good UX is an important, oft-overlooked consideration, but there is definitely such a thing as taking it too far. If your humans are expecting this level of hand-holding, it's because you've trained them to expect it by pandering to…

FWIW the comment you're calling out here is four years old: https://github.com/npm/npm/blame/d3095ff20b8ea01e7fbf93a4a69... , before npm inc was formed. The correctMkdir change seems more recent, but not really related to that specific comment.

This could be my inner grumpy old man speaking, but as a general rule of thumb, I look very poorly on editorializing in code comments. Originally because I didn't want my junior devs embarrassing the company when our clients received control of the code we wrote, but that also transferred into my perception of open source.

That comment should not have survived 4 years. Again, inner grumpy old man showing through.

Edit: to be clear, such comments are treated as reflective of the people and organization behind them.

Re: Do not use NPM 5.7

#33

Post by jguimont »

jlgaddis wrote: post #25

I just can't feel sorry for folks when I see comments like this one: > This destroyed 3 production server after a single deploy! I do think that the developers have a duty to do some testing of their software before putting out releases/updates. However, users also have a duty to perform sufficient testing before they push new versions to their production environments. In my opinion, it's kinda like losing data becau…

I am the one who reported this ;) In fact that was a single production server that I tried to reinstall 3 times before catching it was not really one of the commits that was doing this. No data was lost or connectivity (as long as you do not reboot it), you just lose any ssh connection/login.

Should I have done this on a staging server? Sure, but that does not change the fact that I would have had to rebuild the whole server there too. It is not expected that updating npm will kill the complete system it is on... It would be expected to have some deploy failure of some sort.

As previously noted, `npm update -g npm` pulls in version 5.7.0. Version 5.6 is still the latest but for some obscure reason if you have thisupdate anywhere in your deploy script you are screwed.

Re: Do not use NPM 5.7

#35

Post by lucideer »

jergason wrote: post #22
lucideer wrote: post #4

This is really horrific. The idea that correctMkdir() exists at all seems to me to be so wrong-headed. This comment from the source says a lot: // annoying humans and their expectations! Good UX is an important, oft-overlooked consideration, but there is definitely such a thing as taking it too far. If your humans are expecting this level of hand-holding, it's because you've trained them to expect it by pandering to…

FWIW the comment you're calling out here is four years old: https://github.com/npm/npm/blame/d3095ff20b8ea01e7fbf93a4a69... , before npm inc was formed. The correctMkdir change seems more recent, but not really related to that specific comment.

Ah, yeah, you're right. I was looking at it in diff[0] and hadn't noticed it lost context.

With the full comment, it seems they're instead bemoaning having to adhere to a user's config. Not sure which is worse...

[0] https://github.com/npm/npm/commit/94227e15eeced836b3d7b3d2b5...

Re: Do not use NPM 5.7

#36

Post by diggan »

tbranyen wrote: post #31
foepys wrote: post #24

Apart from being a horrific bug, why are people running npm as root? Why don't they install it somewhere below $HOME and modify $PATH? npm is working fine without root permissions. Everything is super dangerous as root, one should avoid using root at all costs until there is no other way.

Because sometimes you are writing software that interacts with hardware at a root level. This is really annoying advice you're giving since its absolute and without context. No, not everything is "super dangerous" with sudo. Get that FUD outta here!

npm should never interact with hardware, it's job is to install and manage packages. I could understand that you have to run nodejs with root, since it actually can use the hardware.

But using npm with root user? I can't think of a single usecase.

Re: Do not use NPM 5.7

#37

Post by yorwba »

tbranyen wrote: post #31
foepys wrote: post #24

Apart from being a horrific bug, why are people running npm as root? Why don't they install it somewhere below $HOME and modify $PATH? npm is working fine without root permissions. Everything is super dangerous as root, one should avoid using root at all costs until there is no other way.

Because sometimes you are writing software that interacts with hardware at a root level. This is really annoying advice you're giving since its absolute and without context. No, not everything is "super dangerous" with sudo. Get that FUD outta here!

The reason raw hardware access is limited to root is usually because it's "super dangerous", i.e. the consequences of your actions can be more far-reaching than usual and mistakes might have you lose more than just time.

Re: Do not use NPM 5.7

#38

Post by amelius »

jlgaddis wrote: post #25

I just can't feel sorry for folks when I see comments like this one: > This destroyed 3 production server after a single deploy! I do think that the developers have a duty to do some testing of their software before putting out releases/updates. However, users also have a duty to perform sufficient testing before they push new versions to their production environments. In my opinion, it's kinda like losing data becau…

What strikes me as odd is that there are a lot of immature comments in that thread.

Re: Do not use NPM 5.7

#39

Post by plopz »

jergason wrote: post #22
lucideer wrote: post #4

This is really horrific. The idea that correctMkdir() exists at all seems to me to be so wrong-headed. This comment from the source says a lot: // annoying humans and their expectations! Good UX is an important, oft-overlooked consideration, but there is definitely such a thing as taking it too far. If your humans are expecting this level of hand-holding, it's because you've trained them to expect it by pandering to…

FWIW the comment you're calling out here is four years old: https://github.com/npm/npm/blame/d3095ff20b8ea01e7fbf93a4a69... , before npm inc was formed. The correctMkdir change seems more recent, but not really related to that specific comment.

Seemingly even older: https://github.com/npm/npm/commit/d519f4bd7249cc0c19baca16c3...

Re: Do not use NPM 5.7

#40

Post by lucideer »

zdragnar wrote: post #32
jergason wrote: post #22

Earlier quoted context omitted.

FWIW the comment you're calling out here is four years old: https://github.com/npm/npm/blame/d3095ff20b8ea01e7fbf93a4a69... , before npm inc was formed. The correctMkdir change seems more recent, but not really related to that specific comment.

This could be my inner grumpy old man speaking, but as a general rule of thumb, I look very poorly on editorializing in code comments. Originally because I didn't want my junior devs embarrassing the company when our clients received control of the code we wrote, but that also transferred into my perception of open source. That comment should not have survived 4 years. Again, inner grumpy old man showing through. Edi…

I think there should definitely be limits to this—some brevity/levity can be positive—so I would always try to err on the side of acceptance, but in general I agree. In this particular case at least, this comment seems to betray some hint of an anti-user sentiment.
Post reply on HN