Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Left-pad as a service

left-pad.io

Post reply on HN
Print view View original

121–130 of 269 posts

Re: Left-pad as a service

#121

Post by golergka »

mreiland wrote: post #93
smt88 wrote: post #54

Earlier quoted context omitted.

PHP is absolutely the last language I thought anyone would accuse of missing standard features. PHP is massive and includes absolutely insane numbers of functions to do everything. If you can think of 3 basic, universal functions that PHP doesn't include, I'd be shocked. Also, PHP 7 has absolutely nothing to do with standard libraries, as it doesn't really add anything in that regard.

the cool kids make fun of PHP. You must not be a cool kid.

Everybody makes fun of PHP.

Re: Left-pad as a service

#122

Post by Anchor »

icebraining wrote: post #105
deong wrote: post #79

Earlier quoted context omitted.

What's that, you say? I can't "unpublish" my own code? Fine then, here you go. $ echo "function leftpad(str, len, ch) { return ""; }" > leftpad.js $ git commit -a -m "fuck you" && git push There is (obviously, I would say) no possible solution to the problem of the maintainer of a module you depend on deciding to mess with you. The only serious way to even make a go of it is to move your repository to a curated model…

That wouldn't mess with me. It would just create a new version, while my dependencies tracking file is locked to the previous one. I only fetch new versions to my local development machine, and only update the dependencies file after testing it locally and on the staging server.

How about adding a line that alters the output randomly every 1000th second. Is your UI testing strategy good enough to pick that up? Or do you code review all your dependencies on version changes?

I was bitten by a JS function change in a package that has been named also in this thread. It was an "oh, we moved that functionality to a new function, but reused the old name for a new function that does nothing like the old". And no semantic versioning.

Slipped through UI testing and broke production functionality. I did not like dependencies before, and I like them even less now.

And people keep wondering why everyone's software is so ridiculously bad.

Re: Left-pad as a service

#123

Post by ChemicalWarfare »

pfooti wrote: post #111
ChemicalWarfare wrote: post #104

BUG! (I think) using '#' as a 'ch' value pads the string with spaces: $ curl ' https://api.left-pad.io/?str=wat&len=10&ch=#' {"str":" wat"} Please provide github link to fork/submit pr :)

Pretty sure you have to urlencode hashes, don't you? What happens if you do ch=%23?

good point :) API needs to add a POST support with explicit description of rationale being the need to url encode characters when using a GET.

Also needs HATEOAS.

Re: Left-pad as a service

#125

Post by pfooti »

deong wrote: post #72
naasking wrote: post #59

Earlier quoted context omitted.

> This is a straw man argument. The reason so many people are criticizing left-pad et al is about the cost of adding a dependency. The cost of a dependency for a good package manager is zero, and the cost of not having that dependency is non-zero. So the problem is with NPM, not with adding a dependency.

"Zero" isn't a cost of anything -- there's no free lunch. NPM, like any package manager, pretty much blindly accepts user input. I, as a module maintainer, could happily change every single function in my modules to function whatever() { return "WHHEEEEEEE!!!"; } and check it in. Doing that will result in no fewer problems than just deleting the module entirely, and it's not NPM or any other similar package manager's…

If you do that, won't you have to increment your version number? Because with npm, except for left-pad due to oddities of the npm-specific ^ semver operator, you always have to increment your version and you can always pin earlier versions. That said, the ^ sevmer operator would probably upgrade to your sabotaged version if you went from 1.2.3 to 1.2.4, and people would have to figure out what the other operators meant.

As to curated package managers, I'd consider them a great counter-example. Try installing a recent (5.x) version of node and postgres (9.4) on ubuntu. You can go through the rigmarole of adding an entirely new repository for postgres (apt.postgresql.org) since the debian distributed version of postgres is rather old (and ubuntu-version specific). You can also do the same thing with nodesource for nodejs, but if you install node on ubuntu, you'll get a packet radio service instead.

Curated package managers are very conservative and move very slowly. Javascript is a relatively fast-moving, pretty anarchic environment.

The lesson of left-pad is probably: vendor your node deps and check them in. And also: npm probably needs to be replaced with a write-once store with cryptographic signing of packages. You still have to trust the author, but that's the point of open source. We're built on trust.

Re: Left-pad as a service

#126

Post by pfooti »

TickleSteve wrote: post #38
faizshah wrote: post #24

I don't understand why this community has to have a weekly cycle of bashing different programming communities. Every week there's a new drama thread bashing Java devs, Go devs, Javascript devs etc. The thing that I come to this community for every week is to read about new developments in our industry, if you don't come here for that then what are you coming here for? And wasn't it just a few months ago people were p…

its called self-regulation. Each community has its own quirks and extremes as seen by everyone else. Without the bashing, they would become even more extreme. At least after this a lot of devs will think twice about making "micro-modules".

I'm pretty sure that attitude is called "paternalism". Self-regulation works better when it's self-directed, as opposed to other-directed (as in, someone else doing the regulation).

`I shouldn't do ${foo} because people will make fun of me` is a horrible attitude to foist on anyone else, and anyone who tries to propagate that attitude isn't helping the community at all.

Re: Left-pad as a service

#127

Post by krallja »

tromp wrote: post #77
TickleSteve wrote: post #13

Earlier quoted context omitted.

3 maybe.... iteration-as-a-service also??

2 micro-services should suffice for all computation: $ curl 'https://api.S.io/?x=x&y=y&z=z' {"S":"x z (y z)"} $ curl 'https://api.K.io/?x=x&y=y' {"K":"x"}

This is actually how AWS Lambda works under the covers.

Re: Left-pad as a service

#128

Post by andy_ppp »

pgpkkg wrote: post #49
andy_ppp wrote: post #8

Hahaha - isn't it hysterical how everyone using npm for small reusable code pieces! Aren't they morons! How stupid of people to trust their package manager to be consistent and correct and return packages they were expecting. How stupid of people to reuse small often used functions that only do one thing well. How does everyone taking the piss intend to protect themselves from this in their OS package manager, or PPM…

There are two main factors that you're ignoring: The first is that every added dependency creates ongoing cost, and that in a world where it becomes typical for a single application to have hundreds of dependencies, this cost is non-trivial and is, at minimum, worth considering. The second is that even before the left-pad fiasco, a lot of experienced individuals (myself included) believed that npm is fragile by desig…

>>> a lot of experienced individuals (myself included) believed that npm is fragile by design

I agree with you!

>>> you're accusing others of failing to fully understand the situation and of being condescending and rude

I'm saying that people who say "massive helpers.js file yo" is not a solution. Improve the standard lib, npm and use lodash.

I'm also saying we all rely on other package managers so don't think just because you saw npm as flawed you get a free ride to say this couldn't happen with other systems. All of them have various ways of poking holes in any security you think they have.

At some point you have to put trust in your package manager. I'm riling against the people saying to copy and paste code everywhere.

>>> The fact that your post is top of HN is just more evidence that Hacker News is no longer a useful website. It's kind of funny, YC gets better every year, but HN gets worse. I wonder at what point Sam and pg will realize that this cesspool is actually hurting their brand.

Disagree sure, but I think to say that my post is from a cesspool is a bit over the top!

Re: Left-pad as a service

#129

Post by nradov »

mdemare wrote: post #110
morsch wrote: post #52

Earlier quoted context omitted.

The Java standard library is anemic? As in Java SE? That's rich. Java SE is an everything but the kitchen sink standard library, with functionality like collection classes, local and networking IO, windowing toolkits (more than one), database connectivity, the list goes on. There is no language with a less anemic standard library, and Java SE is often criticized for being too large.

Java SE includes a lot, but it does emphatically not include a reasonable amount of useful string methods. These are the javadocs for string: https://docs.oracle.com/javase/7/docs/api/java/lang/String.h... and these are the rubydocs: http://ruby-doc.org/core-2.3.0/String.html The difference is absolutely massive. When working on Java projects, I've always included commons/StringUtils reflexively, and even then Ruby i…

Much of that functionality is in other Java SE standard library classes. You can do left padding with Formatter.

http://docs.oracle.com/javase/8/docs/api/java/util/Formatter...

Re: Left-pad as a service

#130

Post by kelvin0 »

andy_ppp wrote: post #8

Hahaha - isn't it hysterical how everyone using npm for small reusable code pieces! Aren't they morons! How stupid of people to trust their package manager to be consistent and correct and return packages they were expecting. How stupid of people to reuse small often used functions that only do one thing well. How does everyone taking the piss intend to protect themselves from this in their OS package manager, or PPM…

I'm impressed how fast someone was able to turn this into a Unicorn :-) VCs will be stepping all over each other over this!

Seriously, some languages have broken package systems and it looks like it's not the case for JS ... in fact it's working so well they are used ad nauseam, for trivial things even. This is to be expected from a language that is very flexible, but does not offer 'standard' ways of doing things built in, or at least offers the functionality as part of the distribution of the language libs/modules. JS just hit puberty, and will mature ...

Post reply on HN