131–140 of 224 posts
Earlier quoted context omitted.
Yes, I think a passion about marketing can only result in net-negative for humanity. It's not that I don't value those things, it's that I think they're actively harmful (at least some of them), and that being passionate about them shows very toxic personality traits.
I agree completely, but would say the same of your username.
Earlier quoted context omitted.
The 3rd option is the one Azer describes in the post: He wants to remove his stuff, but isn't sure what the right way to do it is, so he asks npm. npm provides him with a set of scripts to run to remove his stuff, and he, presuming that it's "ok" if npm told him to go ahead and run them, runs them. The impact isn't especially important to him, But since npm just gave him a set of scripts with an implicit "oh okay you…
What would the alternative have looked like? If NPM would have prevented the depublishing, he would have made a scene and in the worst case, they would have looked bad. How they actually handled it, the library author got full freedom but also full responsibility
As opposed to looking much worse? Easy decision.
Earlier quoted context omitted.
11 lines of code! Wow. I had no idea it was that small.
There used to be the general wisdom of, "Don't re-invent the wheel. Let the hive-mind craft utility functions and use those because they'll be battle-hardened, well tested, and you can focus on your core business". I think the left-pad incident helped shatter that myth. He we had huge packages depending on a package which padded a string in an inefficient manner. It turns out that the many eyeballs of the bazaar had…
In what way? Have the dependency trees gotten significantly smaller since then?
Earlier quoted context omitted.
Left-pad was made at a time when tree-shaking wasn't really around, so it was good practice to only include the functions you needed to avoid making websites too heavy. If you just needed a small function then it'd be silly to include a huge utility library like Underscore.
You're missing the point. Nobody with a serious background in software development should ever need to pull in a package to pad a string or check if a number is even or odd. If someone is smart enough to use a package manager, they should be more than capable to write a function to pad a string (assuming the standard library doesn't include one already)!
Earlier quoted context omitted.
11 lines of code! Wow. I had no idea it was that small.
There used to be the general wisdom of, "Don't re-invent the wheel. Let the hive-mind craft utility functions and use those because they'll be battle-hardened, well tested, and you can focus on your core business". I think the left-pad incident helped shatter that myth. He we had huge packages depending on a package which padded a string in an inefficient manner. It turns out that the many eyeballs of the bazaar had…
I remember the incident and what stuck me most is how, for me, this was a clear example of a community (Javascript) that depended too much on dependencies (pun somewhat intended)
I don't know why so many people put so much blame on you. You unpublished a package with 11 lines of code [0]. I don't think you fully understood the frustration it would cause. And you mentioned that in the post.
> NPM didn't show usage stats, and there was almost no activity on Github. As a user, it was impossible to know the impact of unpublishing packages
The root cause imo isn't akoculu unpublishing the package. In my opinion that lies more in the over-reliance on dependencies, the npm policies and maybe also build systems not caching/vendoring code.
[0] https://en.wikipedia.org/wiki/Npm_left-pad_incident#Backgrou...
Earlier quoted context omitted.
> You're aware this happened way before the Microsoft acquisition right? you phrasing implies that you would say what I said if you knew that acquisition happened later. Weird but OK. Anyway then let's just say it is a bad look for NPM and any future buyers who decided this is a worthy company
What is weird? Your phrasing implies that this happened under the stewardship of Microsoft (and is somehow related to Microsoft policies or leadership)
Earlier quoted context omitted.
When was the last time you were threatened (“we’ll will bang on your door and take down your accounts”) by a company like Kik and you defended the principles and values you believed until the end? I’m quite familiar with both western and eastern traditions, don’t know any better source than Ghazali’s “the alchemy of happiness” about how people make decisions. It’s kind of ironic to see people being triggered by just…
[flagged]
Earlier quoted context omitted.
You're missing the point. Nobody with a serious background in software development should ever need to pull in a package to pad a string or check if a number is even or odd. If someone is smart enough to use a package manager, they should be more than capable to write a function to pad a string (assuming the standard library doesn't include one already)!
While you are correct, the problem compounds when popular package developers choose to use tiny packages. I don't need left-pad. But maybe I need react-starter-kit. Now, imagine that react-starter-kit has a dependency to markdown-js-blobber, which has a dependency to make-text-nice, which has a dependency to left-pad. In this scenario I am now "pulling in a package to pad a string". If I am "smart enough to use a pac…
I have to admit that I don't understand half of this blog post, feels like I'm missing some context, but I do like that the "left pad guy" does a post mortem. That said, this seems like a weird argument to me: > but I still don't understand why NPM didn't take the time to find out if any of my modules were widely used and consider ways to handle the unpublishing without breaking anything Sure, NPM's unpublish mechani…
They do in fact curate the registry, mainly for reporting vulnerabilities to consumers and to remove malicious packages.