111–120 of 1001 posts
Earlier quoted context omitted.
Stale libraries are more likely to contain known security vulnerabilities.
I know it's bad practice, but I just checkin vendor files/libs to source control. Makes auditing new releases of libraries a bit easier. Assuming they aren't binaries of course.
npx depcheck colors
npx depcheck fakerMaintainers should be able to do whatever they want either their code
But if they vandalize their modules that should be a lifetime ban from the registry
It’s pretty obvious that node needs a better method for dealing with this by now
Earlier quoted context omitted.
This is true for npm. After the incident with leftpad, you can't unpublish anymore. You can, however, publish a new patch update that completely breaks everything.
> This is true for npm. After the incident with leftpad, you can't unpublish anymore. You can, however, publish a new patch update that completely breaks everything. You absolutely can unpublish, it just requires more steps. If NPM gets a DMCA takedown request they will absolutely have to fulfill it.
* no other packages in the npm Public Registry depend on
* had less than 300 downloads over the last week
* has a single owner/maintainer
So while your point is taken that unpublishing is possible under some circumstances, it is not for popular packages that are in use today.
Earlier quoted context omitted.
What damage did they cause?
Do you really expect anyone to believe that you're asking that in good faith?
> now what stop trying to save a couple of bucks by reusing functionality that's not that hard to just develop in-house maybe?
only helps if people developing the functionality that is difficult to develop in-house do the same. i'm not going to build my own AWS cdk.
Everyone decloud and only use the standard libraries compilers provide. What a wonderful world! Everyone is forced to do some system programming. Going to be pain in the beginning but then whoever really passionate about programming (not shipping products but programming) is going to be happy.
OK just joke :/ Although I do secretly wish to wake up one morning and find out we have to do things like in the early 90s.
It's a bit wild that the sum total money spent on salaries for engineers handling potential problems stemming from this or defending against the possibility in the future could probably have covered paying the maintainer a living wage many times over.
Individual contributors in large companies, especially, would want their companies to fund FOSS projects they use. But approval processes are generally extremely complicated and there's nothing to gain internally by doing it. And we're talking about money that these corporations spend each millisecond. They barely need approvals for many other activities costing 10x, 100x in other domains.
GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724
right...