Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A one-line package broke `npm create-react-app`

github.com

Post reply on HN
Print view View original

191–200 of 478 posts

Re: A one-line package broke `npm create-react-app`

#191

Post by ddevault »

zulgan wrote: post #186
ddevault wrote: post #66

Earlier quoted context omitted.

No, this does not happen everywhere. Show me this happening in Debian.

haha i understand what you mean, but debian's https://wiki.debian.org/DontBreakDebian page is not an accident :) i made my comment more as a joke, shit happens everywhere, and as i said maybe not to this extend.

All of this is telling users how to avoid breaking Debian, and mistakes that they ought to avoid. This isn't Debian being broken and the users being collateral damage. This isn't a symptom of the very Debian ecosystem itself being fundamentally broken.

Re: A one-line package broke `npm create-react-app`

#192

Post by jackewiehose »

aylmao wrote: post #157
jackewiehose wrote: post #49

I think these one-line-packages aren't the right way to go. Either JS-developers should skip the package-system in that case and just copy and paste those functions into their own project or there should be more common used packages that bundle these one-liners. I mean is_promise() and left_pad() are not worth their own package. Packages-dependencies of 10000 packages for trivial programs are just insane. Is someone…

I see a lot of criticism to one-line packages, but IMO in the end what matters is the abstraction. Thinking of the package as a black box, if the implementation for left-pad or is-promise was 200 lines would it suddenly be ok for so many other packages to depend on it? Why? The size of the package doesn't make it less bug-prone. I see plenty of people who are over-eager to always be up-to-date, when there really isn'…

> The size of the package doesn't make it less bug-prone.

Of course it does. It's more bug-prone just by being a package. More code is more bugs and more build-system annoyance is more terror (=> more bugs). If I only need one line of functionality I will just copy and paste that line into my project instead of dealing with npm or github.

> Dependencies are part of your source

I agree. If you see news about broken packages like this and you don't just shrug your shoulders your build-system might be shit.

Re: A one-line package broke `npm create-react-app`

#193

Post by zbentley »

kroltan wrote: post #75
degraafc wrote: post #55

Earlier quoted context omitted.

I'd say that it should rather be a part of the type system. Some kind of `obj isa Promise` should be the way to do this, not random property checks. But that's JS...

The thing is that there is the Promise "class", which is provided by the environment, but there is a interface called PromiseLike, which is defined as having a method called then that takes one or two functions. Now, JS doesn't have nominal typing for interfaces, so you have to do "random property checks". Typescript partially solves that by declaring types, but if you have a any variable, you still need to do some p…

> Perhaps if TS or an extension allowed "materializing" TS, that is `value instanceof SomeInterface` generated code to check for the existence of appropriate interface members, this could be avoided

It's not perfect and a bit of a bolt-on, but io.ts works reasonably well in this area:

https://github.com/gcanti/io-ts

Re: A one-line package broke `npm create-react-app`

#194

Post by drinchev »

staticassertion wrote: post #45
chvid wrote: post #7

And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }

Here's my off-the-cuff take that will not be popular. A function like this should be a package . Or, really, part of standard js, maybe. A) The problem it solves is real. It's dumb, but JS has tons of dumb stuff, so that changes nothing. Sometimes you want to know "is this thing a promise", and that's not trivial (for reasons). B) The problem it solves is not straightforward. If you Google around you'll get people sa…

Yeah, but the question is how far should we go with that. Should we do :

    const isFalsy = require("is-falsy");
    const isObject = require("is-object");
    const isFunction = require( "is-function" );
    const hasThen = require( "has-then" );

    function isPromise(obj) {
      return !isFalsy(obj) && ( isObject(obj) || isFunction(obj) ) && hasThen( obj );
    }
Just because the code line is more than 50 characters, doesn't mean that we need a new library for that.

Re: A one-line package broke `npm create-react-app`

#195

Post by x86_64Ubuntu »

throwanem wrote: post #107

The problems that beset the Javascript ecosystem today are the same problems that beset the Unix ecosystem, back in the 90s when there still was one of those. TC39 plays the role now that OSF did then, standardizing good ideas and seeing them rolled out. That's why Promise is core now. But that process takes a long time and solutions from the "rough consensus and running code" period stick around, which is why instan…

And your example is why we have the "lol javascript trash amirite" chorus, because as you've noted these problems were solved decades ago. Yet for some reason, the JS and npm ecosystems always seem to have some dependency dustup once or twice a year.

Re: A one-line package broke `npm create-react-app`

#196

Post by hu3 »

bdcravens wrote: post #188
rubyn00bie wrote: post #144

Call me crazy, but... I don't add things to my projects without looking at the source. Mostly because it saves me from shit like this. If I see something is small enough, and easy enough to reason about, I'll just copy-pasta that motherfucker with a comment citing the source and date it was pasta'd (license permitting). Things like this are so not worth a package, ever, it's something when you see it you go "oh yeah,…

create-react-app contains over 1000 packages. How long would it take to review all of those?

There are alternatives to create-react-app.

In fact, there are alternatives to React.

Re: A one-line package broke `npm create-react-app`

#197

Post by jen20 »

sneak wrote: post #67

I hope that more packaging systems take the go modules approach and cryptographically and immutably identify their dependencies at time of addition to the project. This sort of breakage shouldn’t be possible.

This kind of breakage is perfectly possible in Go also - though the most common equivalent of "left-pad broke my project" for many Go developers is "X changed the case of their GitHub username and now all my import paths are broken".

Re: A one-line package broke `npm create-react-app`

#198

Post by globular-toast »

xyst wrote: post #175
rubyn00bie wrote: post #144

Call me crazy, but... I don't add things to my projects without looking at the source. Mostly because it saves me from shit like this. If I see something is small enough, and easy enough to reason about, I'll just copy-pasta that motherfucker with a comment citing the source and date it was pasta'd (license permitting). Things like this are so not worth a package, ever, it's something when you see it you go "oh yeah,…

tbh, it's something that should be included in a standard library (not a third party package or dependency)

Or just copy and paste it into your project. Using a dependency for one line is beyond ridiculous.

Re: A one-line package broke `npm create-react-app`

#199

Post by jhanschoo »

staticassertion wrote: post #45
chvid wrote: post #7

And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }

Here's my off-the-cuff take that will not be popular. A function like this should be a package . Or, really, part of standard js, maybe. A) The problem it solves is real. It's dumb, but JS has tons of dumb stuff, so that changes nothing. Sometimes you want to know "is this thing a promise", and that's not trivial (for reasons). B) The problem it solves is not straightforward. If you Google around you'll get people sa…

I don't think it should be a package.

One-liners without dependencies like this should live as a function in a utility file. If justification is needed, there should be a comment with a link to this package's repo.

Re: A one-line package broke `npm create-react-app`

#200

Post by TechBro8615 »

dang wrote: post #161
TechBro8615 wrote: post #2

The package referred to in the clickbait title is `is-promise`

The title doesn't strike me as clickbait. The significant thing is what happened.

Personally as a JS dev, the significant thing is which package it was. These stories happen all the time, so when I see them I’d rather know which package it is at a glance so I know if I’m affected.
Post reply on HN