Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

321–330 of 827 posts

Re: I've Just Liberated My Modules

#321

Post by overgard »

praxulus wrote: post #15

This is a surprisingly effective protest action. It got the attention of an incredible number of people very quickly, and the damage is mostly limited to wasting the time of a bunch of build cops. I don't have much of an opinion on his actual reasons for protesting, but I do think it was a pretty cool protest.

The "attention" he's going to get is people annoyed at him for breaking their shit carelessly over a petty dispute with a third party. I have some stuff at work that uses NPM, and I don't know if he broke it, but my thoughts right now are "fuck that guy" and "I would never use NPM again if I knew how catastrophically badly designed it is" and more broadly "if the JS community is this amateur and petty I'm writing my next server in something else"

Re: I've Just Liberated My Modules

#322

Post by dclowd9901 »

While I don't disagree with OP's angst, fuck them for choosing pride over working products. It's irresponsible and shows a complete lack of maturity. I'll make sure never to consume their modules in the future. God forbid they have a bad day and decides to insert malicious code into their modules.

Re: I've Just Liberated My Modules

#323

Post by profmonocle »

marcuskaz wrote: post #311
ricardobeat wrote: post #255

Earlier quoted context omitted.

Why on earth would someone pay for that if the code is already open source?

v0.0.3 is open source, though there is no license in the Github repo, so murky, but NPM says its WTFPL Since old code is under a very permissive license, then the new owner could create v0.0.4 add code and make the new version closed with a restrictive license. This is where a license like GPL would benefit overall, since all future code requires to be under the same license. Either way, it seems like a dangerous pol…

> there is no license in the Github repo, so murky, but NPM says its WTFPL

The WTFPL licensing comes from the package.json file, which is in the GitHub repo.

Re: I've Just Liberated My Modules

#324

Post by Skywing »

douche wrote: post #19
cammsaul wrote: post #8

Update: NPM takes "unprecidented action [...] given the severity and widespread nature of the breakage" and un-un-publishes left-pad https://twitter.com/seldo/status/712414400808755200

Seriously, it's a disgrace that Javascript has such piss-poor string handling built into it's standard library that such a thing is necessary.

Coming in ES7!

Re: I've Just Liberated My Modules

#325

Post by vacri »

spdustin wrote: post #38
cammsaul wrote: post #8

Update: NPM takes "unprecidented action [...] given the severity and widespread nature of the breakage" and un-un-publishes left-pad https://twitter.com/seldo/status/712414400808755200

This feels very wrong to me. I know, open source, etc., and it's likely that the source license allows it provided the license remain intact, but still... For better or worse (worse, IMHO), the author decided to un-publish his nam modules. He asserted his authority over that package of his code. For npm to usurp his authority, even if the licensing allows it, feels wrong .

The particular license chosen for this module doesn't put any limitations on the code - the 'do whatever the fuck you want' license is as permissive as it gets. If the author doesn't like that, he might want to choose a less permissive license next time around.

Re: I've Just Liberated My Modules

#326

Post by [deleted] »

vjeux wrote: post #97
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

Ideas for improvement: - Add 2 factor authentication for npm publish - When you npm install, add a warning for all the versions that got published without 2 fac - pre-install/post-install scripts should require user to accept or refuse. The simple action of running npm install shouldn't run arbitrary code. - make shrinkwrap by default (and fix all the issues with it) so that running npm install doesn't use different…

[deleted]

Re: I've Just Liberated My Modules

#327

Post by spicyj »

icefox wrote: post #229
larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

Someone with more JS experience can chime in, but isn't this really inefficient in JavaScript? Wouldn't appending rather than pre-pending be better due to the way strings and memory are handled? Or at the bare minimum create the left padding in the loop and tack on str after? Can you use ch.repeat(len) + str; yet in node or if not just do the same idea of doubling in size ch until len is satisfied? while (++i And isn…

Essentially all JS engines implement string concatenation lazily as ropes so there isn't much difference.

Re: I've Just Liberated My Modules

#329

Post by JeremyBanks »

dclowd9901 wrote: post #322

While I don't disagree with OP's angst, fuck them for choosing pride over working products. It's irresponsible and shows a complete lack of maturity. I'll make sure never to consume their modules in the future. God forbid they have a bad day and decides to insert malicious code into their modules.

You should greatly thank him for highlighting the flaws in your system if this caused significant issues.

Re: I've Just Liberated My Modules

#330

Post by STRML »

Klathmon wrote: post #302
ploxiln wrote: post #260

Earlier quoted context omitted.

The overhead is in your management of your dependencies. The size of the module isn't the problem, it's the fact that you end up using so many of them (especially recursively). Consider this specific case. This author moved all their modules from one hosted location to another. Now, if you want to use these modules from that author, you need to update the scripts and configs that install them (some package.json files…

I agree that NPM needs to push namespacing much harder, as that would make the whole process much easier. Also a "provides" field could go a long way into stopping issues like this. Allow packages to say that they provide a package in them that is compatible with another in these version ranges. That would let "API compatible" packages be dropped in to replace even deeply nested packages easily, and would allow easy…

This will become easier with rollup, webpack@2, and so on, which can effectively reduce the penalty of including large modules like lodash by tree-shaking out all of the parts you don't use. I would expect many more utility libraries to then be aggregated into a single package/repo and for users to simply pick and choose functions at will.
Post reply on HN