if isArray gets deleted, can't someone else swap it for a malicious package? And it will automatically get 51M weekly downloads?
I'd replace it with a negation of the original and watch the world burn.
isNotArray is not a ray of sunshine.
I will pay you cash to delete your NPM module
31–40 of 60 posts
Re: I will pay you cash to delete your NPM module
#32This is such an important topic that feels like it's hardly ever talked about. In the common lisp world, it's pretty much a cultural norm to use as few dependencies as possible and stick close to the spec, because part of the strength of CL lies in it having an extremely stable spec with a lot of high quality implementations. Adding dependencies reduces the stability of your project and potentially its portability, which are both serious downsides to consider that are worthy of auditing. Also, in my personal opinion, another strength of CL is that you can get a lot done with far less, which usually makes relying on third party dependencies less necessary, and you can consequently usually fit other people's code in your head pretty easily.
In the nightmare hellscape of mainstream languages like JS and Python on the other hand, it's common practice for projects to have dozens, hundreds, even thousands of dependencies -- and that's without even taking into consideration the dependencies of those dependencies, and then furthermore whether those dependencies are pinned. But since this is JS or Python, the dependencies are almost certainly pinned, which causes even more headaches that makes packaging software in a reproducible and auditable way practically impossible for certain languages. And since there's no stable spec and usually only one implementation, no one thinks about portability at all either; you get what you get and if you're lucky it's not impossible to port to an OS other than Linux. This problem of portability is only compounded on by the potentially massive amount of dependencies some of these projects will have. I don't understand how anyone lives like this but people really need to start being more responsible with the code they put out into the world.
Or one could just take up Drew's satirical software eco-terrorism as the only possible viable praxis for abolishing the present state of software development...
Re: I will pay you cash to delete your NPM module
#33You cannot actually do this at npmjs.org, regularly used packages can only be marked "deprecated" now: https://docs.npmjs.com/policies/unpublish
The article mentions this, and links to the same page.
Re: I will pay you cash to delete your NPM module
#34Should be: "I will pay you cash to delete this one-liner NPM dependency"
Because if we start there, we might actually make this work.
Re: I will pay you cash to delete your NPM module
#35I mean, that isArray example is exactly the kind of code that 99% of developers wouldn't come up with on their own, since it's not intuitive at all to check whether or not the value is an array in that way. If anything I would just be in favor of a name for the package that made it clear that it's intended for legacy compatibility.
There's tons of little utility features like this that are IMO the core of why people use libraries in javascript, but could easily be replaced by a common library offered by the browser.
Base64/hex/binary conversion, type checking, DOM access shortcuts, etc. etc.
Re: I will pay you cash to delete your NPM module
#36Earlier quoted context omitted.
How does this fall under the definition of satire? “the use of humor, irony, exaggeration, or ridicule to expose and criticize people's stupidity or vices, particularly in the context of contemporary politics and other topical issues.” Where’s the humor? Where’s the irony? What is he “satirizing”? He’s trolling and calling it “satire.”
its just a prank bro
I'm not your bro.
Re: I will pay you cash to delete your NPM module
#37I mean, that isArray example is exactly the kind of code that 99% of developers wouldn't come up with on their own, since it's not intuitive at all to check whether or not the value is an array in that way. If anything I would just be in favor of a name for the package that made it clear that it's intended for legacy compatibility.
They could find it on StackOverflow and copy-paste it. Searching for "Javascript is array" on DDG or Google even returns the SO answer before the NPM package.
Re: I will pay you cash to delete your NPM module
#38controversial opinion - I actually like having all these libraries that do the same thing, because I have a nicely documented searchable catalogue of code snippets to put into my own utils.js!
Re: I will pay you cash to delete your NPM module
#39You cannot actually do this at npmjs.org, regularly used packages can only be marked "deprecated" now: https://docs.npmjs.com/policies/unpublish
The article mentions this, and links to the same page.
Still, though, could there not be a similar scheme where instead of unpublishing the module, the maintainer intentionally inserts a divide by zero somewhere and pushes it as a minor update?
Re: I will pay you cash to delete your NPM module
#40Somebody need to write busybox of node_modules and alias all the single-liners out to subdirectory of it, i.e. dependencies: { isArray: "busybox/isArray" }