Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not use NPM 5.7

github.com

Post reply on HN
Print view View original

221–230 of 233 posts

Re: Do not use NPM 5.7

#221

Post by ninkendo »

zaarn wrote: post #3

Excuse me, but what the fuck? Looks like the line responsible checks if the npm binary is run as sudo and then uses the UID and GID of the invoking user when chowning the directory. [ https://github.com/npm/npm/blob/latest/lib/utils/correct-mkd... ] I feel like screaming, who thought this was a good idea? If I invoke something as sudo, why does anyone think it should try to detect that and do anything about it? I wan…

I'd go further and say that chown should be "considered harmful".

There are 3 use cases I can think for chown(2):

- Implementing the chown command (or other tools whose purpose is explicitly and only to manage permissions)

- Implementing a file copy/archive command that preserves permissions

- For package managers that set up a daemon user for a package, and want to set up the a writable area of the fs for use by that user

In other words, the ownership of files is something that should be totally up to the user, and not something implicitly done by a tool on their behalf.

I can't think of a single other place where trying to automatically manage file ownership is warranted. Files I touch should be owned by me, files root touches should be owned by root, and the correct way to make sure new files are not owned by root is to not be root. Doing literally anything else with chown is being overly clever and is a guaranteed landmine.

Re: Do not use NPM 5.7

#222

Post by x2e2l2a »

A user of NPM that needs to use `sudo npm` simply did not properly install nodejs into the user directory. NPM is packaged with the node version you are running. So if you installed node with a root user or in a directory that requires root user access you will need to sudo to use `npm`. But if you properly install node under your user you will never have an issue. Anyone that does `sudo npm` did not install nodejs under their user. This may be confusing to people because a lot of tutorials tell you to use `sudo npm`. NPM is a piece of software that is consumed by millions of people and different devices. It is crazy to think there will be no side effects to how people use something where it was not designed.

Re: Do not use NPM 5.7

#223

Post by ashtonian »

rootlocus wrote: post #212
ashtonian wrote: post #158

https://www.dayssincenpmbroke.com/ accepting PRs: https://github.com/Ashtonian/dayssincenpmbroke.com

Do you really need google analytics for this?

need is a strong word. Do I need the entire site - no. The mentality was more like "oh haha joke site?.... I wonder how many people are actually looking at the site and from where.. man I wonder if there is a solution for that... oh right google analytics."

Re: Do not use NPM 5.7

#224

Post by paulddraper »

diggan wrote: post #208
paulddraper wrote: post #116

Earlier quoted context omitted.

> npm is not for managing system software Debatable but irrelevant. I'm not saying npm is a good or bad system package manager, just that running arbitrary scripts for requested packages and their dependencies is hardly unique. It's oblivious to single out npm as a package manager that allows you to be pwned by packages in whatever repo you pull from.

It's not unique, but apt/pacman does not run arbitrary scripts. It runs what has been reviewed by others while npm packages are often not reviewed by anyone except the author, that's the difference.

So you're saying it's not the tool or packaging format. It's the curation of the repositories that npm/apt/pacman users tend to consume.

Re: Do not use NPM 5.7

#225

Post by rootlocus »

ashtonian wrote: post #223
rootlocus wrote: post #212

Earlier quoted context omitted.

Do you really need google analytics for this?

need is a strong word. Do I need the entire site - no. The mentality was more like "oh haha joke site?.... I wonder how many people are actually looking at the site and from where.. man I wonder if there is a solution for that... oh right google analytics."

> I wonder how mwany people are actually looking at the site and from where.. man I wonder if there is a solution for that... oh right google analytics.

And I wonder if it's possible to make a 2 dollar website without tracking your users or reporting to google.

I expect most people who dabble with technology use an adblocker anyway which blocks requests to google analytics.

I wouldn't mind a self hosted analytics solution, but with all the captchas and the mails, I feel we give google enough information as it is.

Re: Do not use NPM 5.7

#226

Post by Piskvorrr »

zdragnar wrote: post #32
jergason wrote: post #22

Earlier quoted context omitted.

FWIW the comment you're calling out here is four years old: https://github.com/npm/npm/blame/d3095ff20b8ea01e7fbf93a4a69... , before npm inc was formed. The correctMkdir change seems more recent, but not really related to that specific comment.

This could be my inner grumpy old man speaking, but as a general rule of thumb, I look very poorly on editorializing in code comments. Originally because I didn't want my junior devs embarrassing the company when our clients received control of the code we wrote, but that also transferred into my perception of open source. That comment should not have survived 4 years. Again, inner grumpy old man showing through. Edi…

I think it's even more harmful: "there's the comment that code does X, so the code does X" (or in this case, an implicit hint that the code fixes non-X) - in other words, wishful thinking.

Re: Do not use NPM 5.7

#227

Post by yogaboll »

officialchicken wrote: post #156

It's been almost 2 years since the great left-pad debacle[0]. The last major npm issue[1] was less than 2 months ago. While the underlying npm registry security issues will remain for a while (and other languages don't seem to have these issues with their package managers), there doesn't seem like there's too much I can do other than use yarn. And hope an alternative registry will appear. Since I 'vote' with my code…

As far as I know it's not feasible to use Github repos instead of npm, at least for client-side code. Most packages are compiled from ES6 (or typescript, jsx etc) to ES5, and the generated code (which is what you want in your project) is usually not included in the git repo.

Re: Do not use NPM 5.7

#228

Post by austinshea »

fenwick67 wrote: post #130
btown wrote: post #16

Earlier quoted context omitted.

At the risk of troll-engaging: there's a huge difference between using an independently-auditable, multiple-contributing-entity, open-source library that happens to have been originated by a social network's engineering team, and using the identity-tracking public APIs of a closed social network. And both can be useful in certain situations. Be wary, but don't close oneself off to good technology just because it's as…

You are right that their OSS doesn't spy on you, but... > don't close oneself off to good technology just because it's associated with technology you disapprove of I disagree, if you think Facebook is evil, don't use their libraries. Using them gives Facebook positive publicity and good will.

OSS can of course spy on you. You just have a reasonable way to audit that software, and find that out for yourself.

If you can audit it yourself, why not use it? I won't follow you on your quest to rid yourself of things created by corporations that I find to be evil.

It's your opinion, sure, but using a corporation's tech does not ensure positive publicity or good will.

Re: Do not use NPM 5.7

#229

Post by thom_nic »

dvlsg wrote: post #161
thom_nic wrote: post #151

Earlier quoted context omitted.

The ironic part here is, part of npm's core design - installing all deps to `./node_modules` - makes it extremely easy to "build" on one machine and then zip up the whole project directory which only needs `node` to run. This is in fact way easier than options for python, ruby (and probably many others) which tend to install versioned dependencies to some shared directory and then add them to the path at runtime. So…

Unless you have native modules and are building on a machine that is different (windows, etc) from your deployment target. And sure, there are ways around that too, but it's not always as simple as copying and pasting the dependencies.

This is true. Thankfully node-pre-gyp helps here because you can build the native modules once for each target arch/platform. I actually have a node app that uses several native modules, and `npm install` it for an ARM target from an x86 host. It also works cross-OS (e.g. build on MacOS for linux.) The key flags are `npm install --production --target_arch=arm --target_platform=linux`.

Re: Do not use NPM 5.7

#230

Post by ashtonian »

rootlocus wrote: post #225
ashtonian wrote: post #223

Earlier quoted context omitted.

need is a strong word. Do I need the entire site - no. The mentality was more like "oh haha joke site?.... I wonder how many people are actually looking at the site and from where.. man I wonder if there is a solution for that... oh right google analytics."

> I wonder how mwany people are actually looking at the site and from where.. man I wonder if there is a solution for that... oh right google analytics. And I wonder if it's possible to make a 2 dollar website without tracking your users or reporting to google. I expect most people who dabble with technology use an adblocker anyway which blocks requests to google analytics. I wouldn't mind a self hosted analytics sol…

wellllllllll when you make a website as a joke you can choose which if any analytics solution you want. And deal with the critics that use analytic blockers to complain about your analytics solution.

The site collected 10k visits over 3 days from around the world.

Post reply on HN