Live data from Hacker News

Left-Pad (2024)

azerkoculu.com

211–220 of 224 posts

Re: Left-Pad (2024)

#211
post #19

> I have to admit that I don't understand half of this blog post It's because you haven't read al-Ghazali yet. (definitely the most pompous and self-important part of this post)

>(definitely the most pompous and self-important part of this post)

What compels you to say this? Would you be more satisfied if he'd suggested the reader acquaint themselves with Thomas Aquinas or Augustine of Hippo? Are you familiar with al-Ghazali, the scholar, or is he new to you?

You have, rather literally, proven the philosophers point - while remaining, it seems, ignorant of it.

Or perhaps, you mean to imply that /u/akoculu was doing a good deed not because he cared, but to show off?

The irony is, al-Ghazali asked his readers to question their pomp and self-importance, and to do good deeds because they truly cared, not because it would result in social acknowledgement by the mass collective, whose motives should always be questioned, effectively.

Perhaps, then, your position is more of a reflection of your own condition? One would hope your disdain is borne on an actual understanding of al-Ghazali's position, vis a vis self-doubt ... or rather, one would hope your current position is based on an ignorance of his works, actually.

One should never feel so compelled to deny the enlightenment of others, especially if by doing so, you resort to personally-motivated obscurantism in response.

Re: Left-Pad (2024)

#212

Earlier quoted context omitted.

There used to be the general wisdom of, "Don't re-invent the wheel. Let the hive-mind craft utility functions and use those because they'll be battle-hardened, well tested, and you can focus on your core business". I think the left-pad incident helped shatter that myth. He we had huge packages depending on a package which padded a string in an inefficient manner. It turns out that the many eyeballs of the bazaar had…

> Apparently it has now finally arrived in ES2026 ES2017 [1]. The MDN docs always link the latest version of the spec; the year in the link doesn't correspond to the version where it was added. The proposal was already mostly done at the time of the incident [2] [1] https://tc39.es/ecma262/2017/#sec-string.prototype.padstart [2] https://github.com/tc39/proposal-string-pad-start-end

Oh, I see, sorry the "Specification" section is definitely misleading then by not also linking to the earliest specification it was included in.

Re: Left-Pad (2024)

#213
post #67

Earlier quoted context omitted.

We westerns do the know much about the Socrates from the eastern side of the world. I can only imagine people from there know who al-Ghazali was just like we know who Sartre was. So, im gonna try and read something by al-Ghazali.

Let me explain myself on this; When this happened, people started making assumptions. A few of them: 1. I’m irrational 2. I’m angry 3. I’m greedy They came to one of these conclusions, based on how they see themselves in the same position. I can be of course one of these three in some other situations, but in the left pad incident, I done all purely with my heart, to stick to my values and principles which was behind…

Hey - thank you for your interesting post today. It set me off on a personal journey which, in my mind, involved the discovery of many secret trails and camping spots, metaphorically ..

One thing I have learned about al-Ghazali today, thanks to your efforts, is that philosophers aren't always right, faith and logic can work together, and doubting everything can lead to truth.

But, most importantly, live ones faith honestly - and this is especially true for those of us who detest imperialist/corporate interference in spiritual activities, such as publishing packages to the npm ecosystem intended to make ones fellow human beings lives' more rewarding, in spite of the lack of personal rewards to be gained in doing so.. that the value in seeing this is lost on a lot of HN responses in this thread so far, is no big surprise - but it is surely disappointing.

I hope you will consider adding Aquinus and Augustine of Hippo to your references, also. Sometimes it helps to see how the universality of true philosophy crosses cultural divides.

Re: Left-Pad (2024)

#214
post #204

Earlier quoted context omitted.

Check this discussion: https://news.ycombinator.com/item?id=43867827

Responding to client requests can be nice, sure, but having to be available outside working hours is still awful, and that's the defining characteristic of what people usually mean by oncall.

I agree, but iLoveOncallTasksButNotTheHours doesn't have the same ring to it.

Re: Left-Pad (2024)

#215

Earlier quoted context omitted.

It was implied I wrote it knowingly. If that's what you would write knowingly sure, but I think it's weird.

Okay, I understand what you are saying now. You were not aware Microsoft did not own them yet. I did not glean that from your response

Yep, I would use different words if I was

Re: Left-Pad (2024)

#216

Earlier quoted context omitted.

Sure, but that license doesn't include the requirement to host in perpetuity, and anyway, I wouldn't expect a hobbyist to need to worry about this. If I decide to make my gamer-profile private / offline or something and that breaks your crawler, even though I previously granted unrestricted public access to that data, that's really not my problem.

Let’s not pretend he was hosting the software. Npm was. No software developer or organisation will use a software repository that allows deletion of packages. That’s why it’s not a thing anymore. If you think this “right” should exist, that’s a market niche for you to exploit. But you won’t, will you? Because like I said, no user wants this.

??? I didn't say anybody using npm wants this. I'm saying npm had the wrong policy around deletion, that npm could have handled the situation differently, and also that Azer not knowing or caring about the effects of removing the package doesn't make him an asshole or even negligent (although it also doesn't mean he ISNT an asshole; that's a separate matter).

The point is that Azer didn't owe anybody anything; not even to know what he was doing. npm did.

That said, I'm glad the wake-up call came in such a relatively benign way.

Re: Left-Pad (2024)

#217

To me it is very strange how many companies do not internally mirror every single dependency of their builds. You should be able to do a clean build fully offline (and not count on luck with the download caches).

Include them as git submodule and you have that for free.

Re: Left-Pad (2024)

#218
post #154

Earlier quoted context omitted.

I don't think so, but at least awareness of dependencies as liabilities has increased. I installed `pass` (the lightweight password manager) on a fresh headless system the other day and it brought in like 60 packages including a bunch of X stuff.

Just checked on a fresh install of Fedora 42 "custom operating system" install, so pretty minimal. Didn't even check the "standard tools" box or whatever it's called. Installing 'pass' pulled in: desktop-file-utils emacs-filesystem git-core libpng qrencode qrencode-libs Plus weak (optional) dependencies: libwayland-client mailcap wl-clipboard xdg-utils 12 packages, 5 MB download, 24 MB installed. Could be worse, coul…

On my particular (Ubuntu) system, `debtree pass` shows 301 dependencies (includes subdependencies) for a total install of 130 MB.

One of the big trigger is the dependency pass->xclip. That sets off a big cascade of X.

Re: Left-Pad (2024)

#219

Earlier quoted context omitted.

While you are correct, the problem compounds when popular package developers choose to use tiny packages. I don't need left-pad. But maybe I need react-starter-kit. Now, imagine that react-starter-kit has a dependency to markdown-js-blobber, which has a dependency to make-text-nice, which has a dependency to left-pad. In this scenario I am now "pulling in a package to pad a string". If I am "smart enough to use a pac…

I don't place any blame here on the person using `react-starter-kit` and I think you're being a bit obtuse to suggest otherwise. It's the original person who pulled in a package for <10 lines of code who is to blame.

I provided the real reason for the high download counts of these packages.

Re: Left-Pad (2024)

#220
post #119

Earlier quoted context omitted.

Well, I sure can! When you develop software by gluing together 1000000 small packages, you now have 1000000 points of failure. When you develop software by... you know, writing trivial things by yourself instead of downloading a package... you have maybe 100 points of failure instead of 1000000 points of failure. Having 100 points of failure is better than having 1000000 points of failure. Note that in this example y…

I don’t quite follow the reasoning. You can reverse the argument: When one package breaks, then — all else being equal — more dependents are likely to be affected if it is a large package with many functions than if it is a tiny package with just one function. What made the left-pad incident prominent is that the package had so many dependents. That’s due to how frequently its functionality is useful, not due to its…

I specifically said in my post that I did not make the argument you think I made.

Here is a copypaste of the part where I clarified that:

> So we're not taking the same set of code as dependencies, slicing it into different number of slices, instead we're taking less code as dependencies.

Post reply on HN