Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not use NPM 5.7

github.com

Post reply on HN
Print view View original

161–170 of 233 posts

Re: Do not use NPM 5.7

#161

Post by dvlsg »

thom_nic wrote: post #151
kakwa_ wrote: post #82

Earlier quoted context omitted.

What you say is 100% true, but I would go one step further and not have npm installed on any production server. And it's not specific to npm, I would do the same with gem, pip, cpan, etc. Not to mention curl http://ex.io/install.sh | sudo bash. Call me old school, but personally, I would avoid installing anything from language specific package managers. I would instead either build an rpm/deb package for every depend…

The ironic part here is, part of npm's core design - installing all deps to `./node_modules` - makes it extremely easy to "build" on one machine and then zip up the whole project directory which only needs `node` to run. This is in fact way easier than options for python, ruby (and probably many others) which tend to install versioned dependencies to some shared directory and then add them to the path at runtime. So…

Unless you have native modules and are building on a machine that is different (windows, etc) from your deployment target.

And sure, there are ways around that too, but it's not always as simple as copying and pasting the dependencies.

Re: Do not use NPM 5.7

#162

Post by mundanevoice »

TAForObvReasons wrote: post #160
officialchicken wrote: post #156

It's been almost 2 years since the great left-pad debacle[0]. The last major npm issue[1] was less than 2 months ago. While the underlying npm registry security issues will remain for a while (and other languages don't seem to have these issues with their package managers), there doesn't seem like there's too much I can do other than use yarn. And hope an alternative registry will appear. Since I 'vote' with my code…

The left-pad debacle was a registry issue but the current issue is an npm client issue. In my experience, NPM 5 client versions have been shaky and unreliable, and there are problems with popular ecosystems like react-native [0]. I always roll back to npm 4, even on node 9. [0] https://github.com/facebook/react-native/issues/14209

The quality of what's being delivered since version 5 leaves a lot to be desired. They should really more people to their team and someone better since a lot of people depend on this code. Also, what's up them not understanding how semver works and releasing a pre-release code as the regular version. That's pretty basic man and rarely someone is OSS fucks up this badly actually.

Re: Do not use NPM 5.7

#163

Post by enzanki_ars »

master-litty wrote: post #135

http://blog.npmjs.org/post/171169301000/v571 Thankfully, it only affected users running `npm@next`, which is part of our staggered release system #STOPUSINGPRERELEASEWITHSUDO Really now? #ANGRYORANGEWEBSITE #PEOPLEGOTMAD :)

This is just absolutely unprofessional.

All tags:

#ANGRYORANGEWEBSITE #PEOPLEGOTMAD #STOPUSINGPRERELEASESWITHSUDO #CLIHOTFIX #WEGOTUBB #LITERALLYKILLEDGITHUB

Author:

FEBRUARY 22, 2018 (9:53 AM) @MAYBEKATZ

https://web.archive.org/web/20180222201315/http://blog.npmjs...

Re: Do not use NPM 5.7

#164

Post by kuon »

homulilly wrote: post #148
kuon wrote: post #138

Running npm as root is bad, either install the npm package from your distribution (apt, pacman...) or, to use `npm install -g` edit `.npmrc` add `prefix=/home/ /.node` in it, and add `~/.node/bin` to your path.

It's bad, but at the same time it's hard to blame people doing it too much when it's literally in the npm documentation: https://docs.npmjs.com/troubleshooting/common-errors

I am not blaming people, maybe my comment wasn't formulated properly. What I meant is "don't do it, there is an alternative".

I think no documentation should ever include sudo in their commands. You should put a note "depending on your environment, some of those commands might require root privileges" or something.

Re: Do not use NPM 5.7

#165

Post by kakarot »

explodingcamera wrote: post #159
officialchicken wrote: post #156

It's been almost 2 years since the great left-pad debacle[0]. The last major npm issue[1] was less than 2 months ago. While the underlying npm registry security issues will remain for a while (and other languages don't seem to have these issues with their package managers), there doesn't seem like there's too much I can do other than use yarn. And hope an alternative registry will appear. Since I 'vote' with my code…

Github paths can change way more easily than npm packages, users can rewrite git history + break your stuff and versioning when using it with npm is horrible. NPM also now protects projects from namesquatting and prevents you from deleting them when multiple projects depend on them.

How does NPM protect from namesquatting now?

Re: Do not use NPM 5.7

#166

Post by kakarot »

diggan wrote: post #93
zaarn wrote: post #43

Earlier quoted context omitted.

I think the easy solution here would be to disable global installs. Pip does that same stuff and it also is known to get people's computers into quite advanced states. Ideally npm should simply setup a dedicated directory in /opt or /usr/local/ (ie, /usr/local/node/bin or /opt/node/bin) in which it dumps all the global stuff. That way you can easily set permissions for a user and/or contain any damages to that folder…

> easy solution here would be to disable global installs I think that's not optimal. Having package being installed "globally" (as in available on your PATH) is nice. You can install `yarn` by doing `npm install --global yarn`. The trouble is how people setup their node/npm installation. Instead of having global packages setup under the home directory, people use the default which requires root access. Instead, defau…

> The trouble is how people setup their node/npm installation. Instead of having global packages setup under the home directory, people use the default which requires root access.

No, like you say in your next sentence the trouble is that it's default. This is NPM's fault, not the user.

Re: Do not use NPM 5.7

#168

Post by whatever_dude »

I swear NPM has some absurd showstopping bug every month.

With something that has as many people using it, it's just... I dunno, it's disheartening.

Edit: oh well, this was a @next release only. Not as bad. Still scary.

Re: Do not use NPM 5.7

#169

Post by lhorie »

btown wrote: post #5

There appear to be no unit tests for their entire lib/utils folder. Which includes things like this (misguided) chown utility. https://github.com/npm/npm/tree/release-next/test - and note the lack of testing in the commit linked in the bug report. I had an inkling that NPM was cancer, but not like this. Yarn, by contrast, has everything you would expect of a Facebook-engineered library: https://github.com/yarnpkg/yar…

Not only does it not have any regression tests, it also fails the CI check, and it's already merged to the next branch.

https://github.com/npm/npm/pull/19889

This kind of thing disintegrates my confidence on npm as a project.

Re: Do not use NPM 5.7

#170

Post by whatever_dude »

woah wrote: post #48
grahamj wrote: post #8

Earlier quoted context omitted.

"everything you would expect of a Facebook-engineered library" So it collects your personal information, even when not using it, and uses it for profit?

I don’t like Facebook much, but their engineering is very good

Only when your needs align with theirs. Which, truth be told, is fairly common. But they have a tendency to ignore or give low priority to other people's needs, like certain features that don't meet "Facebook scale" or, just, documentation (see: Relay).
Post reply on HN