And this is why I avoid "package managers" that follow the wild-west model like the plague.
[deleted]
Many packages suddenly disappeared
251–260 of 520 posts
Re: Many packages suddenly disappeared
#252Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?
Left-bad, I mean, the left-pad fiasco should have been the wake up call.
Re: Many packages suddenly disappeared
#253Earlier quoted context omitted.
seems like a good reflection of the current social climate: they have a policy to prevent mildly offensive package names, and they enforce it, but they don't have a solution to packages randomly disappearing and being replaced with malicious versions.
Or it could be that it's easy to do simple low-hanging-fruit things and harder to do more complicated things. The whole JS ecosystem has come together in a rather ad-hoc way, it's plain stupidity or moronic political gamesmanship to assume more motivation than "nobody thought it worth blocking the entire platform to build a fully-trusted base infrastructure so far." It's funny how many people get easily pissed off ab…
> it appears their reaction to getting some power for the first time in their lives was to jump into the bully camp themselves
Or maybe they see others using political correctness to bully people around them.
Re: Many packages suddenly disappeared
#254Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?
Yikes, what is it about node/npm/javascript that makes it feel like a house of cards? I think the (short) answer is "node, npm, and javascript". The longer answer has something to do with the automatic installation of dependencies, and the common use of shell scripts downloaded directly off the internet and executed using the developer's or sysadmin's user account. I used to use CPAN all the time. CPAN would check de…
> I used to use CPAN all the time...
CPAN has a setting that force-feeds you dependencies without asking, but I don't think it's on by default. Also, CPAN runs tests by default, which usually takes forever, so users get immediate feedback when packages go dependency-crazy. The modern Perl ecosystem is often stupidly dependency-heavy, but nothing like Node.
Re: Many packages suddenly disappeared
#255Earlier quoted context omitted.
That's okay, but it's not enough - it's easy to swap two letters and do similar substitutions to fool many users. If a package is downloaded 10,000 times every day, surely once in a while someone will misspell the name somehow. Other than that, their reaction to similar incidents was to wait for somebdoy on twitter to notify them, ban the responsible users, and hope that it won't happen again. It's still extremely ex…
Yup. The best answer I can come up with given their constraints (some self-imposed) is to force all new packages to be scoped.
how many typosquats on scope names will there be I wonder.
Re: Many packages suddenly disappeared
#256Earlier quoted context omitted.
Somehow i imagine a native C-Desktopdev and a Webdeveloper meeting in No-Mans Land each party escaping from its own nightmare with that line on the lips, starting with a "Dont run into this direction-"
At my job we do native C and C++, some Java, some C#, scripting in Shell, Python, and Perl. When the left-pad incident happened someone said something to the room about it, we all looked it up, and spent a good 15 minutes mind-boggled, laughing and being grateful we weren't web devs. "Wait, you're telling me these people need NPM and GitHub to deploy? Seriously?"
>these people need [their package manager] and [their source code management tool] to deploy? Seriously?
Not really sure I understand what you're implying there
Re: Many packages suddenly disappeared
#257Earlier quoted context omitted.
They document that they curate package names here: https://www.npmjs.com/policies/conduct I guess lots of people will think that a policy like Avoid using offensive or harassing package names, nicknames, or other identifiers that might detract from a friendly, safe, and welcoming environment for all. stifles their inner something or other though.
seems like a good reflection of the current social climate: they have a policy to prevent mildly offensive package names, and they enforce it, but they don't have a solution to packages randomly disappearing and being replaced with malicious versions.
It's like how companies still enforce their no masturbating at your desk social mores even when there is urgent business.
Re: Many packages suddenly disappeared
#258Earlier quoted context omitted.
I have recently taken over an Angular project (with a C# backend, thankfully) at my job. It took two hours to get it to even compile correctly because some dependencies were apparently outdated in package.json and it just ran on the other dev's machine by accident. I don't understand why I need over 100 dependencies for a simple Angular Single Page App that pulls JSON from the backend and pushes JSON back. Meanwhile,…
Three developers on my team spent the last 4 years pushing for angular. Four years ago, I was 50/50 on it vs react, so whatever, but if my team's really for it, let's do it. Fast forward to angular 2, and we're down to two developers who are still for it. Fast forward to today, I'm down to one angular dev who's still for it, and two of the original three have left for react jobs. Meanwhile, I'm left with a bunch of a…
I don't understand. We've started a new Angular 2+ project and our junior developers managed to roll into quite easily. Our designers (who know jack about Javascript) got excited when they discovered that our project uses .scss and the results have been spectacular.
Seriously, I REALLY REALLY don't get this hate for Angular 2+
Re: Many packages suddenly disappeared
#259Earlier quoted context omitted.
How does RubyGems handle a package being removed and replaced by a different (and maybe malicious) actor? Not allow a package to be deleted? Block the package name from being claimed by someone else?
From http://help.rubygems.org/kb/gemcutter/removing-a-published-r... : > Once you've yanked all versions of a gem, anyone can push onto that same gem namespace and effectively take it over. This way, we kind of automate the process of taking over old gem namespaces.
There are also people requesting that this be changed: https://github.com/rubygems/rubygems.org/issues/1226
Re: Many packages suddenly disappeared
#260PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…
I'm surprised there wasn't a global lock-down on new package registrations (or at least with the known names of lost packages) while they were working to restore them.