Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Npm operational incident, 6 Jan 2018

blog.npmjs.org

Post reply on HN
Print view View original

181–190 of 197 posts

Re: Npm operational incident, 6 Jan 2018

#181

Post by vbrandl »

_pmf_ wrote: post #164
fencepost wrote: post #40

Independent of npm's issues now and in the past, how vulnerable are other package managers to similar problems? There were typosquatting issues with pip, replacement issues with Rubygems, probably others that I don't recall. What's the current state of things for the more commonly used languages?

Maven/Gradle don't allow un-namespaced packages; nobody knows for sure how deep up their arse npm's designers have had their ass when they made non-namespaced packages possible (even the only way in the beginning; I don't know if it's still the default). Additionally, there's the problem of npm's fine-grained dependencies (that have become a laughing stock in itself), in my Java large projects, while I don't know eve…

`Crates.io` (the Rust package ecosystem) doesn't have namespaces and operates after the first come first serve principle. They won't resolve namesquatting issues so something like the left-pad debacle won't happen. I think their policy[0] is quite sane. At least I'm not aware of any issues of that kind regarding crates.io.

For typosquatting: I don't think that problem can be easily solved by package registries. They could warn you if there is a package with a similar name (and more votes, downloads, what ever) but aside from that, the developer should double check the dependency names and that's it.

[0]: https://crates.io/policies

Re: Npm operational incident, 6 Jan 2018

#182

Post by MikkoFinell »

MikkoFinell wrote: post #155
always_good wrote: post #121

Earlier quoted context omitted.

I think it's annoying but also toxic to an ecosystem. You have to name your packages the same way you look for a domain name, people can squat on names, and it causes drama like how the 'kik' package was stolen from a developer and given to a company who never used it. Nobody would've cared it the package was "tzs/kik". For example, the Elm package system does this right. Another example of this failure is the Reddit…

The failure is yours alone if you actually consider Reddit an authority on anything.

Downvoters: I of course meant an authority on anything ELSE than memes and karmawhoring. Sorry for not being clear about that.

Re: Npm operational incident, 6 Jan 2018

#183

Post by dbbk »

Lazare wrote: post #142
swsieber wrote: post #140

Everybody is mad/disappointed at/by the NPM for their handling... Does this have any real impact on the NPM package adoption though? There is no alternative node module package directory, is there? It seems like any action they could have taken would have had exactly the same effect (well, maybe some prospective products don't adopt JS backends, but you have all webpack projects locked in pretty tight, right?)

I've been using gitpkg ( https://github.com/ramasilveyra/gitpkg ) lately; it works pretty well. Basically lets you use a git repo as a package repo, instead of npm. Very little about how I use npm requires it to be centralized; I don't ever search npm looking for a package to install; I find a package I want and then look to install it.

Couldn't you just use github IDs in your package.json directly? npm and yarn both have support for it.

Re: Npm operational incident, 6 Jan 2018

#184

Post by Lazare »

dbbk wrote: post #183
Lazare wrote: post #142

Earlier quoted context omitted.

I've been using gitpkg ( https://github.com/ramasilveyra/gitpkg ) lately; it works pretty well. Basically lets you use a git repo as a package repo, instead of npm. Very little about how I use npm requires it to be centralized; I don't ever search npm looking for a package to install; I find a package I want and then look to install it.

Couldn't you just use github IDs in your package.json directly? npm and yarn both have support for it.

Short answer: Sure, but it works much better with gitpkg.

Long answer: Sometimes you can do that, yes. But you'll run into issues with "modern" frontned toolchains and complicated packages where you want to write ES2017 code, transpile it with babel, bundle it with webpack, make a universal lib, etc., and push the result to your package repo, but not commit it to your git repo.

Gitpkg handles all the wierd corner cases, and lets you keep build artifacts out of your git repo, and raw source out of your package repos. And if you use github you can even use the github IDs in your package.json, but the result is going to be a lot better. If you're just writing a plain one file package for use in node that doesn't need any processing, eh, no need for gitpkg.

Re: Npm operational incident, 6 Jan 2018

#185

Post by _pmf_ »

amyjess wrote: post #136
tedivm wrote: post #22

Earlier quoted context omitted.

Yeah, about two years ago NPM stole a package name from an existing user and gave it to a company to use. The user then said that if he can't trust NPM to actually treat package naming fairly then he was just going to delete all of his packages[1]. This broke a ton of packages on people (in part due to "left-pad" disappearing), so the community went ahead and registered/uploaded all of the packages to NPM again. Afte…

I hope this leads more developers to begin using restrictive trademark terms for their work, like Mozilla does with their software (e.g. you cannot fork Firefox and still call it "Firefox") or what Tuomo Valkonen did with ion3. And for that matter, this sounds like a pretty strong disincentive for developers to make their code open-source at all. I'd rather just release proprietary software under a license that allow…

IIRC, Tuomo was also dissatisfied with the state of Linux on the desktop in general.

Re: Npm operational incident, 6 Jan 2018

#186

Post by smarx007 »

yoodenvranx wrote: post #99
flavio81 wrote: post #74

It is really another embarrasment for NPM, considering that this is not the first time something similar happens (see: left-pad issue, 23 march 2016) So they learnt zero from it. Then, WHEN ARE THEY GOING TO SIGN THOSE PACKAGES? Zero, nothing. They didn't learn from mistakes, they don't listen. NPM is still open to all sorts of malicious use. Besides NPM problems, yesterday many packages won't work because package "p…

Someone should grab the 100 most used packages which contain less than 30 lines of code, merge it into one package and call it 'npm standard library'.

I have no idea why there are negative comments to this suggestion. I do a lot of Java development and Apache Commons as well as Google Guava are two of the most popular libraries.

Re: Npm operational incident, 6 Jan 2018

#187

Post by jmcqk6 »

Lazare wrote: post #21

Very displeased about this response. > In yesterday’s case, we got it wrong, which prevented a publisher’s legitimate code from being distributed to developers whose projects depend on it. We identified the error within five minutes and followed defined processes to reverse this block. Unfortunately, the process was complicated by well-meaning members of the npm community who believed that a malicious actor or securi…

>This guts any remaining trust I had in npm. Even if I wanted to trust them, they're not even admitting the problem exists; how am I meant to believe they're finally going to fix it? They've stopped even promising to fix this, and moved on to lies and denial.

The cold reality I'm realizing is: what are you going to do about it? If you have tens of thousands of lines of javascript written using dependencies from NPM, what is the next step?

Re: Npm operational incident, 6 Jan 2018

#188

Post by amyjess »

_pmf_ wrote: post #185
amyjess wrote: post #136

Earlier quoted context omitted.

I hope this leads more developers to begin using restrictive trademark terms for their work, like Mozilla does with their software (e.g. you cannot fork Firefox and still call it "Firefox") or what Tuomo Valkonen did with ion3. And for that matter, this sounds like a pretty strong disincentive for developers to make their code open-source at all. I'd rather just release proprietary software under a license that allow…

IIRC, Tuomo was also dissatisfied with the state of Linux on the desktop in general.

A huge chunk of that was that he was fed up with stable distributions shipping older versions of his software, so he'd get inundated by bug reports from users who were reporting things he'd already fixed. He argued that distros like Debian Stable and RHEL were actually more prone to bugs because of this. He wanted distros to use either rolling release or the Microsoft/Apple model, where the OS vendor only ships the base OS and all other software is acquired from third parties.

Because of this, he ended up putting in a termination clause in his license:

> 3. Redistributions of this software accessible plainly with a name

> of this software ("ion", "ion3", etc.), must provide the latest

> release with a reasonable delay from its release (normally 28 days).

> Older releases may be distributed, if the full version, or some

> other explicit indicator, such as the word "ancient", is part of

> the name that the package is accessed with, or if this identifier

> is completely unrelated to a name of this software.

Re: Npm operational incident, 6 Jan 2018

#189

Post by always_good »

MikkoFinell wrote: post #182
MikkoFinell wrote: post #155

Earlier quoted context omitted.

The failure is yours alone if you actually consider Reddit an authority on anything.

Downvoters: I of course meant an authority on anything ELSE than memes and karmawhoring. Sorry for not being clear about that.

Okay.

And you might say the failure is yours alone when you overeat, yet 30%+ of the USA is overweight. This little platitude only makes you feel better about yourself but isn't a good basis for designing something.

Re: Npm operational incident, 6 Jan 2018

#190

Post by amyjess »

olefoo wrote: post #107
5h wrote: post #43

Earlier quoted context omitted.

Just had a quick look - the "kik" package isn't in even use anymore - the whole thing was just drama theatre from by a messaging app I've never heard of. Despite it having 200 million users. Apparently.

In the US Kik has a pretty active userbase; but it's demographics skew older, poorer and more female and more rural. So that might be why you haven't heard of it.

Kik is pretty popular among camgirls. Usually paying for a subscription to them gets you added to their contents on Kik so you can chat with them.

I wouldn't associate that with older, rural people. More female, sure... but then you've also got their male followers.

Post reply on HN