Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not use NPM 5.7

github.com

Post reply on HN
Print view View original

71–80 of 233 posts

Re: Do not use NPM 5.7

#71

Post by mkobit »

kaiby wrote: post #26
boffinism wrote: post #21

Good lord, when I try to follow the link I get the Unicorn error page with the message 'This page is taking way too long to load. Sorry about that. Please try refreshing and contact us if the problem persists.' Has this issue provoked so much outrage that GitHub can't handle the constant stream of angry emojis on the issue comment thread?

I had the same issue. Internet archive link: https://web.archive.org/web/20180222160101/https://github.co...

I can't even get to that page as it times out as well.

EDIT: I opened the original link in incognito mode and the page seemed to load fine.

Re: Do not use NPM 5.7

#72

Post by RX14 »

My personal opinion is that the root cause of the issue is the ability of a language pacakge manager to mess with system files at all (i.e. do a global install of anything). Shards, the crystal package manager makes the sensible design decision to only install libraries into `$PWD/lib` and binaries into `$PWD/bin`. Everything is local only to your project. If you want a binary on your PATH, you can create an installation method that works for your commandline tool's specific usecase. Hopefully a distro/homebrew package.

I wrote about this in longer form here: https://github.com/crystal-lang/crystal/pull/3328#issuecomme....

Re: Do not use NPM 5.7

#73

Post by RX14 »

dharmab wrote: post #54
diggan wrote: post #51

Earlier quoted context omitted.

I don't remember exactly what tool does this, but one package manager (can be homebrew but long time ago I used homebrew) warns users if you are running it as root, since it should install packages as the user. I think npm could implement a similar strategy and educate the users how packages should really be installed.

Several Arch Linux AUR helpers (pacaur and trizen, for example) refuse to run as root. Instead, they invoke sudo to escalate only during the necessary phases.

That's because makepkg rightly refuses to run as root.

    ==> ERROR: Running makepkg as root is not allowed as it can cause permanent,
    catastrophic damage to your system.

Re: Do not use NPM 5.7

#74

Post by mbrumlow »

tbranyen wrote: post #31
foepys wrote: post #24

Apart from being a horrific bug, why are people running npm as root? Why don't they install it somewhere below $HOME and modify $PATH? npm is working fine without root permissions. Everything is super dangerous as root, one should avoid using root at all costs until there is no other way.

Because sometimes you are writing software that interacts with hardware at a root level. This is really annoying advice you're giving since its absolute and without context. No, not everything is "super dangerous" with sudo. Get that FUD outta here!

Right, but that means your service is running with elevated privileges, that does not mean your build tool needs too.

Furthermore if you do have a application that requires root level access then the parts that do should be isolated from the parts that don't. You don't get to just get a blank check to run as root because you need to bind to a low port.

Re: Do not use NPM 5.7

#75

Post by mattbierner »

amelius wrote: post #38
jlgaddis wrote: post #25

I just can't feel sorry for folks when I see comments like this one: > This destroyed 3 production server after a single deploy! I do think that the developers have a duty to do some testing of their software before putting out releases/updates. However, users also have a duty to perform sufficient testing before they push new versions to their production environments. In my opinion, it's kinda like losing data becau…

What strikes me as odd is that there are a lot of immature comments in that thread.

More than the clueless “+1”, I also have noticed an uptick of basically troll comments on GitHub. And while I understand that this particular bug is really bad, GitHub for me has always been about getting shit done and solving problems, a nice escape from the “normal” Internet with all its drama. The fact that people seem to be actively enjoying the drama and are even trying to fuel it—even if this is currently limited to super high profile bugs likes this—is concerning

Re: Do not use NPM 5.7

#76

Post by y4mi »

Piskvorrr wrote: post #63
vetinari wrote: post #53

Earlier quoted context omitted.

Yes, I meant dpkg. Not sure about dpkg, but rpm does not allow two packages to own the same file. If you try to install package, that contains file owned by another, already installed package, the installation will fail (you can try that with installing an amd64 package that owns something in /usr/share, and then try to install the i386 version). Yes, post-install scripts are dangerous and rpm folks are doing small s…

dpkg will throw a fit in the same way.

it will throw an error message, which the user is probably going to ignore and install anyway.

This will ultimately cause errors down the line. Maybe not right now, but eventually problems will occur.

showing a warning is great, but not needing that warning would be preferable.

but most distributions are already working on solutions to that. ubuntu is working on SnapOn's [0] for example, and i remember hearing about something else from redhad as well.

[0] https://snapcraft.io/

Re: Do not use NPM 5.7

#77

Post by al2o3cr »

diggan wrote: post #51
reificator wrote: post #20

Earlier quoted context omitted.

I completely agree with you. But in fairness, I can't count the number of times that I've needed to fix things after people treated `sudo npm` as Simon Says[1]. I'm sure they struggled a lot with that issue before coming to this solution. Was it the right solution? Absolutely not. But that's not the point I'm trying to make. It's all too easy to tunnel vision on a particular solution. I've done it plenty of times, an…

I don't remember exactly what tool does this, but one package manager (can be homebrew but long time ago I used homebrew) warns users if you are running it as root, since it should install packages as the user. I think npm could implement a similar strategy and educate the users how packages should really be installed.

Bundler does something similar - it complains if you run the command with sudo.

Ignoring the warning can result in exciting permissions errors later, which is what I'm guessing the NPM code is trying to avoid.

Re: Do not use NPM 5.7

#78

Post by zdragnar »

lucideer wrote: post #40
zdragnar wrote: post #32

Earlier quoted context omitted.

This could be my inner grumpy old man speaking, but as a general rule of thumb, I look very poorly on editorializing in code comments. Originally because I didn't want my junior devs embarrassing the company when our clients received control of the code we wrote, but that also transferred into my perception of open source. That comment should not have survived 4 years. Again, inner grumpy old man showing through. Edi…

I think there should definitely be limits to this—some brevity/levity can be positive—so I would always try to err on the side of acceptance, but in general I agree. In this particular case at least, this comment seems to betray some hint of an anti-user sentiment.

An appropriate limit is, as I mentioned, editorializing. To be precise, your clients, peers and users should not the the target of your feelings expressed in comments.

An additional litmus should be professional discipline: express dissatisfaction with a todo (ideally referencing a bug or discussion issue source URL or identifier). Without that reference, it acknowledges an issue without indicating any motivation to solve or re-mediate the original cause, which is (IMHO) indicative of a careless and lazy attitude.

Re: Do not use NPM 5.7

#79

Post by CJefferson »

carussell wrote: post #55
foepys wrote: post #24

Apart from being a horrific bug, why are people running npm as root? Why don't they install it somewhere below $HOME and modify $PATH? npm is working fine without root permissions. Everything is super dangerous as root, one should avoid using root at all costs until there is no other way.

`sudo npm install -g` is one of several examples of the normalization of deviance rife in the NodeJS community. Most command-line utilities distributed through NPM recommend running as root (implicitly—because they all suggest installing it as a global package). Here's[1] Microsoft's instructions to install the TypeScript compiler, for example. NPM's awfulness notwithstanding, it's trivial to write a shell script to…

If I run npm without -g, it complains about missing files, and fills my home directory with node_modules junk and a package-lock.json I have to "commit"? Why do I want to commit it, and where?

I'm sure you are now going to tell me there is an easy way to fix that too, and I'd be happy if there was, but for me I just want to use npm to install a program or two.

Re: Do not use NPM 5.7

#80

Post by joshuacc »

carussell wrote: post #55
foepys wrote: post #24

Apart from being a horrific bug, why are people running npm as root? Why don't they install it somewhere below $HOME and modify $PATH? npm is working fine without root permissions. Everything is super dangerous as root, one should avoid using root at all costs until there is no other way.

`sudo npm install -g` is one of several examples of the normalization of deviance rife in the NodeJS community. Most command-line utilities distributed through NPM recommend running as root (implicitly—because they all suggest installing it as a global package). Here's[1] Microsoft's instructions to install the TypeScript compiler, for example. NPM's awfulness notwithstanding, it's trivial to write a shell script to…

I'm mostly a Windows user, so maybe I'm misunderstanding *nix stuff here, but I don't see how recommending npm i -g package is remotely the same as recommending sudo npm. Could you clarify?
Post reply on HN