The package referred to in the clickbait title is `is-promise`
The title doesn't strike me as clickbait. The significant thing is what happened.
A one-line package broke `npm create-react-app`
161–170 of 478 posts
Re: A one-line package broke `npm create-react-app`
#162Earlier quoted context omitted.
I'm a novice in this area but if your project relies on a bunch of external node packages why wouldn't you download them all and host them locally or add them to version control?
Adding them to your own version control is a nightmare: Your own work will drown in all the changes in your dependencies. The repository will quickly grow to gigabytes, and any operation that would usually take seconds will take minutes. It's also just not needed. Simply specifying an exact version ("=2.5.2") will avoid this problem. The code for a version specified in this manner does not change.
Yes, putting your dependencies in version control alongside your project is no fun. Commit history is muddied, but also if your production boxes are running on a different platform or architecture than where you and your team develop, that can make a big mess too.
That said, with a big enough team and risk-averse organisation, it can be a brilliant idea to put your dependencies in /separate/ version control and have your build process interact that way.
In that scenario, even if your dependencies vanish from the Internet (as happened with left-pad), you are still sitting pretty. You can also see exactly what changed when, in hunting for causes of regressions etc.
Re: A one-line package broke `npm create-react-app`
#163Earlier quoted context omitted.
A class with a `then` method isn't a rare thing that could only come up adversarially. Below I've linked two example from the rust std-library (I just chose that language because the documentation is really easy to search for objects which have a method name then). I think we can be sure that both booleans, and the "less than, equal to, or greater than" enum are not in fact promises. https://doc.rust-lang.org/std/pri…
What do Rust idioms have to do with Javascript?
The language has nothing to do with it. The point is just that the name "then" is a perfectly common method name.
If a small standard library is using it for things that aren't promises, you can bet your ass that there are javascript libraries using it for things that aren't promises.
Like I said, I just chose to look at rust first because it's documentation has a good search bar.
Re: A one-line package broke `npm create-react-app`
#164Weinberg's Law: If Builders Built Buildings the Way Programmers Wrote Programs, Then the First Woodpecker That Came Along Would Destroy Civilization.
That's the soft in software.
Re: A one-line package broke `npm create-react-app`
#165Earlier quoted context omitted.
No. Other languages don't publish/import packages that are one line of code . I have never seen an issue like this with any other language that I've worked with. Any sane developer that needed a one-liner like this would just manually implement it. Not to mention that these sorts of functions are unnecessary in languages with a good stdlib or statically typed languages like rust, etc.
Know what happens every time people like you say this here on HN? They post the one-liner they would have manually implemented in their code base and it's wrong . The one that comes to mind is the "is-negative-number" package. Yes, the geniuses of Hacker News, after finding out there was an npm package for determining whether something was a negative number, could not correctly implement that function. You and everyo…
As demonstrated in this reply - https://news.ycombinator.com/item?id=22979718, this package is also wrong. So the argument is invalid?
Re: A one-line package broke `npm create-react-app`
#166Earlier quoted context omitted.
And CI is failing[0]. [0]: https://travis-ci.org/github/then/is-promise/builds
The failing CI here is unrelated to the issue but it's still pretty bad a release was made with failing CI.
It was a five-year release (followed quickly by a 3.5-hour release and a sub-minute release) [0], so they may not have wanted to dig into CI.
Re: A one-line package broke `npm create-react-app`
#167Earlier quoted context omitted.
No. Other languages don't publish/import packages that are one line of code . I have never seen an issue like this with any other language that I've worked with. Any sane developer that needed a one-liner like this would just manually implement it. Not to mention that these sorts of functions are unnecessary in languages with a good stdlib or statically typed languages like rust, etc.
Know what happens every time people like you say this here on HN? They post the one-liner they would have manually implemented in their code base and it's wrong . The one that comes to mind is the "is-negative-number" package. Yes, the geniuses of Hacker News, after finding out there was an npm package for determining whether something was a negative number, could not correctly implement that function. You and everyo…
Please don't use allcaps for emphasis on HN. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html.
As a stretch target: it's a bad idea to create demons out of an assortment of posts you randomly saw on HN. This site gets 3M posts a year. You can find basically anything in there.
https://news.ycombinator.com/item?id=22098687
What happens is that we each have pre-existing images that bug us (e.g. for example, people who overrate their own genius) and as we move around in the statistical cloud, random bits of whatever we run into stick to the pre-existing image and give it form. Poof, you have a demon—but actually it just became visible. Readers with other images see other demons and arrive at other generalizations. It's not good discussion because it's really about one thing but we make it about another, and comments that are skewed in that way limit their own interestingness. (I definitely don't mean to pick on you personally. We all do this.)
Re: A one-line package broke `npm create-react-app`
#168Earlier quoted context omitted.
Know what happens every time people like you say this here on HN? They post the one-liner they would have manually implemented in their code base and it's wrong . The one that comes to mind is the "is-negative-number" package. Yes, the geniuses of Hacker News, after finding out there was an npm package for determining whether something was a negative number, could not correctly implement that function. You and everyo…
As demonstrated in this reply - https://news.ycombinator.com/item?id=22979718 , this package is also wrong. So the argument is invalid?
The package isn't wrong, you're just confused about duck typing.
Re: A one-line package broke `npm create-react-app`
#169Earlier quoted context omitted.
What do Rust idioms have to do with Javascript?
The language has nothing to do with it. The point is just that the name "then" is a perfectly common method name. If a small standard library is using it for things that aren't promises, you can bet your ass that there are javascript libraries using it for things that aren't promises. Like I said, I just chose to look at rust first because it's documentation has a good search bar.
The language has everything to do with it, because the language is the locus of practice. Rust practice is whatever it is, and is apparently pretty free with the use of "then" as a method name, which is fine. Javascript practice isn't the same as Rust practice, and Javascript practice includes a pretty strong norm around methods named "then".
That's why the next time I run into such a method, that doesn't belong to a promise and behave the way a promise's "then" method does, will be the first time I can remember, despite having worked primarily or exclusively in Javascript since well before promises even existed.
I'm sure there is an example somewhere on NPM of a wildcat "then", and that if you waste enough of your time you can find it. So what, though? People violate Rust idioms too from time to time, I'm sure. I doubt you'd argue that that calls Rust idioms themselves into question. Why does it do so with Javascript?
Re: A one-line package broke `npm create-react-app`
#170every package can be a one line package if you minify it. lines of code as a metric for code quality is always relative.
The fact that this is a one line package has nothing to do with the outcome. a one-line code change in a 5000 line dependency could just as much have messed up create-react-app. The size is irrelevant.