241–250 of 1001 posts
Earlier quoted context omitted.
Why does a new version break projects without action by the project owners? In Go you would have to explicitly update to the broken version.
Because npm install has the insane default behavior of adding a fuzzy qualifier to your package.json, for example ^6.0.2 means all of the following versions are accepted: 6.0.2, 6.0.9, 6.7.84
Earlier quoted context omitted.
Why does a new version break projects without action by the project owners? In Go you would have to explicitly update to the broken version.
Because npm install has the insane default behavior of adding a fuzzy qualifier to your package.json, for example ^6.0.2 means all of the following versions are accepted: 6.0.2, 6.0.9, 6.7.84
Cargo even makes it implicit that a version like “1” means “^1.0.0” in Cargo.toml.
Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…
I’m a self taught Python programmer. I haven’t don’t much front end. Why do some JS devs import tiny packages to do simple things? I don’t feel like I’ve seen this behavior in Python. Is it because browsers are an awful environment?
GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724
This is not the way. Github doesn't have the right to tell someone what to do with their own code. The only right thing to do in this situation is to fork the repositories and fix the situation on the npm side. Github doesn't get to ban this guy because he took a dump in his own backyard. EDIT: I suppose the literal DoS attack in the code probably puts him squarely in the "malicious behaviour" category which then giv…
~~ Rich Hickey @richhickey
https://twitter.com/richhickey/status/1338893764702691334
Edit: "Open Source is Not About You" by Rich Hickey
https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...
GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724
Earlier quoted context omitted.
That's another JS ecosystem widespread malpractice. Autobumping versions, or version ranges as they're called in Maven land. Dependencies should only use fixed versions and all updates should be manual. You should only use auto-upgradable versions during development, and the package manager should warn you that you're using them (or your dependencies are).
If package A depends on package C at version 1.0 but package B depends on C at version 1.1, what version of C will be pulled in? Dependency management is not as simple as only upgrading one direct dependency at a time after careful review. The NPM ecosystem is particularly difficult to work with as it has deep and broad transitive dependency trees, many small packages, and a very high rate of change. You either freez…
Most package managers won't allow these stunts and conflicts have to be resolved UPSTREAM. NPM chose to go the "YOLO" way and will fetch every single version of a package that meets the dependency demands. Terrible design, but the purpose of that was growth for NPM, the company, not the best interest of the ecosystem.
Earlier quoted context omitted.
"this software comes with no warranties" ?
Adding this kind of disclaimer notice doesn't mean you can do whatever you want. If you perform action in obviously bad faith, your account will be suspended – it's very simple. Github's terms of service must have somewhere detailed description about it.
Please, point me to the part where bugs, intentional or not, are disallowed.
Taking over someone's account is not justified; for this, definitely, but I'd say it's never is. Block the account yes; take over, no.
Earlier quoted context omitted.
If package A depends on package C at version 1.0 but package B depends on C at version 1.1, what version of C will be pulled in? Dependency management is not as simple as only upgrading one direct dependency at a time after careful review. The NPM ecosystem is particularly difficult to work with as it has deep and broad transitive dependency trees, many small packages, and a very high rate of change. You either freez…
There are package exclusions, package forcing and of course, full dependency tree checks where you review what everything pulls in. The JS ecosystem will probably have to change but because it's so decentralized, that change will be orders of magnitude harder than, for example, PHPs transition from 3 (4, 5) to 7.
Is it? Everybody is pulling from Microsoft owned servers now, as Microsoft owns both Github and NPM.
Earlier quoted context omitted.
Living wage? haha, more like 100 peoples living wage.
In America, most unskilled software developers make somewhere in the $80k to $140k range. A living wage is around $20k for absolute bare minimum essentials. Skilled devs still get around $200k. Point is, maybe 10 people. And that’s if you like ramen.
Moderately skilled it engineers other of backgrounds and devs can make much more than $200k, just go check levels.fyi
To the parent comments point
> It's a bit wild that the sum total money spent on salaries for engineers handling potential problems stemming from this or defending against the possibility in the future could probably have covered paying the maintainer a living wage many times over.
The collective effort across numerous companies is much more than just $200k and you can bet your butt on that.