Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

221–230 of 827 posts

Re: I've Just Liberated My Modules

#221

Post by alextgordon »

spdustin wrote: post #153
swang wrote: post #70

Earlier quoted context omitted.

Nope, nothing wrong. The code he wrote is his, but he doesn't own the npm namespace, which is all anyone cares about here at this point. But you know what also _feels_ wrong? people who had no involvement in this at all having their day get fucked up because of this one dude who _suddenly_, just now realized that npm isn't going to really help him out and did the internet equivalent of taking your ball and going home…

Agreed, that feels wrong too. But is npm supposed to be the recess supervisor in this metaphor, taking the ball back and giving it back to the other kids?

If he wants to control where people get his software, he should have published it under a proprietary license. Not saying he does, though.

Re: I've Just Liberated My Modules

#222

Post by voltagex_ »

Klathmon wrote: post #33
jerf wrote: post #24

This is why you should vendor it. What is "it"? All of it, whatever it may be. You should be able to build your systems without an internet connection to the outside world. I say this with no reference to particulars of your language or runtime or environment or anything else. This is merely a specific example of something that could happen to a lot of people, in a lot of languages. It's just a basic rule of professi…

I agree. I use and love NPM and others like it, but when it comes down to it, i check-in my dependencies when my applications get "released". Committing the updates is only one more step, and in my experience it's not even another step since we already have a rule that new installs or dep updates need their own commit.

It becomes even more important in an "enterprise" environment. I have machines here which are blocked from executing node.exe (at the time, the binary I had wasn't signed).

I have machines here that have to authenticate via SSPI/NTLMv2 to a proxy to get out to the net. And don't even get me started on the SSL MITM we have here.

I can't run your startup's app here. I can't run your new build tool here.

Re: I've Just Liberated My Modules

#223

Post by Manishearth »

st3v3r wrote: post #51
aidos wrote: post #29

Earlier quoted context omitted.

I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste. The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even b…

Should one not be able to unpublish? What if there's a bug in a released version, and it's going to take a while to fix? Or what if you simply no longer wish to be associated with the organization anymore?

Rust/Cargo solves this with a `yank` option. Cargo will no longer automatically switch to that version, but if you already use it, nothing changes (though there might be a warning or something)

Re: I've Just Liberated My Modules

#224

Post by takno »

Klathmon wrote: post #93
seanp2k2 wrote: post #81

Earlier quoted context omitted.

By this logic, every Stack Overflow snippet should be a module. I'm almost hesitant to suggest this since many people who read this will be capable of building such a thing.

I'm not saying that everything should be a module, but that well designed, well tested bits of code should be modules. These 17 lines had 100% test coverage and were used by a stupidly large amount of people (read: battle tested), why not use it? As is pointed out elsewhere in this thread, echo.c is roughly the same size, does that mean it's not a worthy program?

Realistically 17 lines of code is total overkill for this function. In many cases you could achieve the same thing more efficiently in a single line.

Re: I've Just Liberated My Modules

#225

Post by grapehut »

My biggest issue with npm is the lack of verifiable build. Even if I read it on github, I have absolutely no idea if that's exactly what the person uploaded to npm. I very well could have malicious code and not know it.

Re: I've Just Liberated My Modules

#226

Post by Cogito »

thejosh wrote: post #74
jlg23 wrote: post #26

Earlier quoted context omitted.

EDIT: For those with a short attention span, the first paragraph is a drastic metaphor, the second is making my point. If a kid does not get cookies at home it can shoot all its classmates. Lots of media coverage, the kid will get "the attention of an incredible number of people very quickly". NO. For me, publishing code under a FOSS-license means giving back to the community. Anyone who then decides to cause collate…

You must be really fun to be around. Really, comparing this to mass murder, well done. It's more like he had a bunch of toys, someone stamped on one of them and he took the rest home with him whilst the other kids are still playing with them. These are his repositories which he created, he is welcome to remove the code, and others are more than welcome to rehost (as they require). If you are depending on npm (or any…

There wasn't any equivocation in the parent between this event and mass murder.

The mass murder example is a counter point to the (implied) argument in the grandparent that "[getting] the attention of an incredible number of people very quickly" is the same thing as an effective protest.

It is possible to get lots of attention for your action without that attention translating to support for you or your cause.

The parent continues to discuss how they believe there was damage above and beyond "wasting the time of a bunch of build cops" and explicitly states what they think the damage would be.

Perhaps choosing a different example would have been more tasteful, and may have avoided this side discussion and being flagged to oblivion, but it did not ever claim the two events were equivalent.

It's possible that the mass murder example, while not directly compared with the original action, is implied equivalent by the mere juxtaposition of the two but I don't think that was the parent's intent.

Re: I've Just Liberated My Modules

#228

Post by krapp »

shruubi wrote: post #191
camwest wrote: post #96

FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintai…

While I can appreciate the predicament this presents, do you not feel like you are going against the wishes of the original author by essentially overtaking him and publishing his code against his will?

The author's explicit wishes, in no uncertain terms, are that anyone can "do what the fuck they want to with it" [0][1]. I think when he did this, he gave up (willingly, and with a bit of profanity) the right to have any say at all about whether, how or by whom it was published.

[0]http://www.wtfpl.net/

[1]https://github.com/azer/left-pad/blob/master/package.json#L2...

Re: I've Just Liberated My Modules

#229

Post by icefox »

larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

Someone with more JS experience can chime in, but isn't this really inefficient in JavaScript? Wouldn't appending rather than pre-pending be better due to the way strings and memory are handled? Or at the bare minimum create the left padding in the loop and tack on str after? Can you use ch.repeat(len) + str; yet in node or if not just do the same idea of doubling in size ch until len is satisfied?

    while (++i
And isn't this a bug?

leftpad("x", 2, '00') will return "00x"

Re: I've Just Liberated My Modules

#230

Post by camwest »

ploxiln wrote: post #209
camwest wrote: post #96

FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintai…

So if I understand correctly * npm allows a module to be deleted so all fetches of published name-oldversion fail * npm allows you to take-over the name of a deleted module and publish name-newversion * npm does not allow you to "re-publish" name-oldversion which had existed before the deletion but npm ops forced this publish for your special case That's a strange combination of constraints. If you're going to reserv…

Yes you got it right. The third point was the special exception / grey area.

For the record they made sure the exact same code was published to 0.0.3 so that I didn't maliciously inject anything. I control subsequent versions though.

Post reply on HN