if isArray gets deleted, can't someone else swap it for a malicious package? And it will automatically get 51M weekly downloads?
I'd replace it with a negation of the original and watch the world burn.
I will pay you cash to delete your NPM module
21–30 of 60 posts
Re: I will pay you cash to delete your NPM module
#22I wish the conclusion would be different.
The frontend javascript ecosystem can only be described as deranged. If anything, it's a miracle that malicious packages don't happen more often than they do. One of my side projects has over 1000 indirect dependencies (according to ls -l .yarn/cache | wc -l), and it's not a project I'd consider especially fancy. Alacritty has 200 indirect dependencies, and as far as I've seen that's the upper bound for most rust projects. For NPM, it's the lower bound.
Running yarn in firejail/bwrap helps, but it's not easy to set up and sandbox escapes can happen (same with docker).
Re: I will pay you cash to delete your NPM module
#23Re: I will pay you cash to delete your NPM module
#24Earlier quoted context omitted.
It's satire. https://drewdevault.com/2021/11/16/Cash-for-leftpad.html#con...
How is this "satire"? What is this satirizing?
You could call it a modest proposal.[1]
Re: I will pay you cash to delete your NPM module
#25Earlier quoted context omitted.
How is this "satire"? What is this satirizing?
Because he openly, in black and white, says it is satire?
How does this fall under the definition of satire?
“the use of humor, irony, exaggeration, or ridicule to expose and criticize people's stupidity or vices, particularly in the context of contemporary politics and other topical issues.”
Where’s the humor? Where’s the irony?
What is he “satirizing”?
He’s trolling and calling it “satire.”
Re: I will pay you cash to delete your NPM module
#26Why not build a scanner for common structures like "isArray" and automatically submit a PR to replace the usage with built-in tools or something like lodash. (I know program comparison is akin to the halting-problem, but for simple templates it should work).
b/c you get a Dependabot type of thing with 5 million PRs every month
also, during early nodejs phase (2012~14) such bots existed, but were considered generally annoying and not welcomed by the community
Re: I will pay you cash to delete your NPM module
#27Re: I will pay you cash to delete your NPM module
#28Earlier quoted context omitted.
Because he openly, in black and white, says it is satire?
How does this fall under the definition of satire? “the use of humor, irony, exaggeration, or ridicule to expose and criticize people's stupidity or vices, particularly in the context of contemporary politics and other topical issues.” Where’s the humor? Where’s the irony? What is he “satirizing”? He’s trolling and calling it “satire.”
its just a prank bro
Re: I will pay you cash to delete your NPM module
#29Anti-Open Source for real . What about people who value helping others more than the money? and Disagree about the value of the "help" an `npm` package actually is? I like this idea but I can see there's room for disagreement. Say there's a particularly problematic package... are you justified in hiring a bounty coder to replace it? How about a bounty hunter to eliminate its current maintainer? Is the action more mor…
I see your point but I disagree. The solution is having a standard library (even very small), implementing basic features that the language is lacking but are terribly useful and basically everybody implements them on their own (or just import a package as it seems). Other languages managed to do it somehow (with better or worse results), why the JS community can't?
Re: I will pay you cash to delete your NPM module
#30Instead of being constructive and contributing positively to humanity, ddevault takes his talents and attempts to play scorched earth at every turn in the road. There are constructive solutions to this problem. The solutions do not entail breaking literally millions of builds and suggesting that a developer should torch their reputation for, what, $710 (LOL, give me a break, Drew). What we have here is performative a…
If a million builds can break for $700, maybe those builds deserve to break. Then the million developers might actually write resilient software. Where do I send my $700??