Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Left-Pad (2024)

azerkoculu.com

Post reply on HN
Print view View original

171–180 of 224 posts

Re: Left-Pad (2024)

#171

Post by oftenwrong »

lmm wrote: post #117
majorbugger wrote: post #29

Why Java can have reliable utility libraries such as Apache Commons and Google Guava, but JS somehow cannot?

Maven is incredibly well designed (and ironically gets nothing but hate for it), it's probably the hidden reason Java is so successful. Why does Maven exist, without the commercial compromises of NPM? Probably because Java has the well-funded, well-supported, but non-profit and community-oriented Apache foundation, which is something extremely rare and precious (and probably at least partly a lucky result of Java's c…

The operators of Maven Central deserve a lot of credit for their good stewardship. Unlike the NPM registry, Maven Central does not permit anyone to unpublish packages. Unlike the NPM registry, Maven Central requires verification of domain or forge account ownership to claim a namespace. These are good practices, and anyone seeking to create a central package registry would do well to at least consider this. Maven Central is currently operated by SonaType, but it has changed hands a few times. This article covers its history: https://www.sonatype.com/blog/the-history-of-maven-central-a...

Additionally, it is standard practice in the Java world, which is more "corporate" or "enterprise-y", for better and for worse, to have organisations operate their own internal package registries / mirrors. Even if you unpublished a major package from Maven Central, many organisations would be completely unaffected because they retain archived copies of all of their dependencies.

Re: Left-Pad (2024)

#172

Post by anonymars »

throwaway290 wrote: post #137
anonymars wrote: post #96

Earlier quoted context omitted.

What is weird? Your phrasing implies that this happened under the stewardship of Microsoft (and is somehow related to Microsoft policies or leadership)

It was implied I wrote it knowingly. If that's what you would write knowingly sure, but I think it's weird.

Okay, I understand what you are saying now. You were not aware Microsoft did not own them yet. I did not glean that from your response

Re: Left-Pad (2024)

#174

Post by anonymars »

baobabKoodaa wrote: post #93
anonymars wrote: post #90

Earlier quoted context omitted.

Instead of teasing, can you just tell us what the difference is between unpublishing N small packages versus one large package containing the same set of functionality?

Well, I sure can! When you develop software by gluing together 1000000 small packages, you now have 1000000 points of failure. When you develop software by... you know, writing trivial things by yourself instead of downloading a package... you have maybe 100 points of failure instead of 1000000 points of failure. Having 100 points of failure is better than having 1000000 points of failure. Note that in this example y…

These seem like two independent concerns:

1. How the dependencies are broken up

2. Whether to take dependencies at all ("buy or build")

It's still not clear to me how taking a larger dependency (with things I might not need) is inherently better than taking smaller dependencies. That seems like a question of trade-offs. What if there's an issue or security hole in a portion of the larger dependency that I didn't even use? For example, that log4j LDAP debacle, what if that were broken down into smaller dependencies so that you didn't even have the LDAP thing if you weren't using it?

Re: Left-Pad (2024)

#175

Post by BenjiWiebe »

beej71 wrote: post #154
eviks wrote: post #133

Earlier quoted context omitted.

> the left-pad incident helped shatter that myth In what way? Have the dependency trees gotten significantly smaller since then?

I don't think so, but at least awareness of dependencies as liabilities has increased. I installed `pass` (the lightweight password manager) on a fresh headless system the other day and it brought in like 60 packages including a bunch of X stuff.

Just checked on a fresh install of Fedora 42 "custom operating system" install, so pretty minimal. Didn't even check the "standard tools" box or whatever it's called.

Installing 'pass' pulled in: desktop-file-utils emacs-filesystem git-core libpng qrencode qrencode-libs

Plus weak (optional) dependencies: libwayland-client mailcap wl-clipboard xdg-utils

12 packages, 5 MB download, 24 MB installed. Could be worse, could be better.

I was honestly expecting Fedora to have less than that.

Re: Left-Pad (2024)

#176

Post by bayindirh »

nindalf wrote: post #170
akoculu wrote: post #163

Earlier quoted context omitted.

[flagged]

[flagged]

I don’t see a problem in someone deleting 1, 100 or 1000 repositories and moving on. Neither Open Source nor Free Software makes no promises of indefinite availability of the source code.

Incidentally, HTTP has a status code for this. It’s 410 - Gone.

Which is devised for exactly this purpose.

Re: Left-Pad (2024)

#177

Post by hu3 »

praptak wrote: post #122

To me it is very strange how many companies do not internally mirror every single dependency of their builds. You should be able to do a clean build fully offline (and not count on luck with the download caches).

Yep.

I vendor dependencies on the projects I work.

Predictable, offline builds. Storage is cheap.

Re: Left-Pad (2024)

#178

Post by olalonde »

akoculu wrote: post #127
nindalf wrote: post #19

> I have to admit that I don't understand half of this blog post It's because you haven't read al-Ghazali yet. (definitely the most pompous and self-important part of this post)

When was the last time you were threatened (“we’ll will bang on your door and take down your accounts”) by a company like Kik and you defended the principles and values you believed until the end? I’m quite familiar with both western and eastern traditions, don’t know any better source than Ghazali’s “the alchemy of happiness” about how people make decisions. It’s kind of ironic to see people being triggered by just…

It seems what you really meant was:

> And third, they haven't read Al-Ghazali, don't quite understand how I make decisions.

Not everyone makes decision guided by the heart. Many people lean more on reason and logic.

Re: Left-Pad (2024)

#179

Post by akoculu »

olalonde wrote: post #178
akoculu wrote: post #127

Earlier quoted context omitted.

When was the last time you were threatened (“we’ll will bang on your door and take down your accounts”) by a company like Kik and you defended the principles and values you believed until the end? I’m quite familiar with both western and eastern traditions, don’t know any better source than Ghazali’s “the alchemy of happiness” about how people make decisions. It’s kind of ironic to see people being triggered by just…

It seems what you really meant was: > And third, they haven't read Al-Ghazali, don't quite understand how I make decisions. Not everyone makes decision guided by the heart. Many people lean more on reason and logic.

> Many people lean more on reason and logic.

Yes, when theres's no impulse strong enough to outweigh reasoning. You don't need Ghazali for this, Kant also explains it. Before suggesting that I rephrase things, I think you should explore the domain first.

Re: Left-Pad (2024)

#180

Post by olalonde »

bayindirh wrote: post #176
nindalf wrote: post #170

Earlier quoted context omitted.

[flagged]

I don’t see a problem in someone deleting 1, 100 or 1000 repositories and moving on. Neither Open Source nor Free Software makes no promises of indefinite availability of the source code. Incidentally, HTTP has a status code for this. It’s 410 - Gone . Which is devised for exactly this purpose.

It used to be a "gentleman's agreement," but now npm enforces it - as a result of this guy's actions.
Post reply on HN