Live data from Hacker News

Many packages suddenly disappeared

github.com

461–470 of 520 posts

Re: Many packages suddenly disappeared

#461
post #438

Earlier quoted context omitted.

I've known plenty of developers whose automatic response to `packagemanager install packagename` failing is `sudo packagemanager install packagename`.

I sincerely hope all modern package managers, when invoked with sudo, immediately spawn a very-low-privilege process that does most of the work sandboxed to /tmp/whatnot, and the root process just copies files to the right place and runs some system calls to update databases etc.

Most package managers I know support Turing complete install hooks. How would a package manager detect what parts of those require/are safe to run with root?

Re: Many packages suddenly disappeared

#462
post #445
post #338

Earlier quoted context omitted.

With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. Really seems like deleted packages should be frozen forever - if the original author never recreates it or transfers ownership, then people would have to explicitly choose to move to some new fork with a new id. But your point about pressuring or bribi…

> With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. CPAN requires the old author to explicitly transfer or mark it abandoned-and-available-to-new-owner. For all the things wrong with perl5 (and I love it dearly but have spent enough time I can probably list more things wrong with it than the people wh…

This happens all the time. The new generation creates something cool because what our parents created isnt cool any more, only to fail exactly on the same spot as our parents. Only, it was already solved in the parents last version. This goes for cloth design, cars, houses, kitchen wares and so on, as well as software. Just look at the microwave oven earlier...

Re: Many packages suddenly disappeared

#463
post #47

And this is why I avoid "package managers" that follow the wild-west model like the plague.

What's the wild-west model? Write it all yourself? "cp -r $dependency_location $install_location"? Genuinely curious.

The "wild west" model is where there is no maintainer or distributor between the developer and consumer that is allowed to perform any sort of quality control or sanitisation. That sounds good from a naive standpoint - who needs this busybody middleman anyway? But the problem is that authors tend not to be great maintainers. Authors can (and do) remove packages at any time, make changes to packages without bumping version numbers, upload subtly broken versions or possibly make user-hostile changes which the community can then do nothing about short of creating a fork (which is messy switching over dependencies to a different package name). And that's not even to go into typo-squatting.

In short, package authors don't tend to care about much more than getting their package to work, somehow, anyhow. Often only the latest version of that package, too. And they don't always have an eye on interoperability with other packages, or consistency across a collection. Maintainers who create a "distribution" of software that works well together can collaboratively make decisions that are in the community's best interest. The "wild west" model is unilateral, the "maintained" model is multi-lateral.

Re: Many packages suddenly disappeared

#464
post #462
post #445

Earlier quoted context omitted.

> With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. CPAN requires the old author to explicitly transfer or mark it abandoned-and-available-to-new-owner. For all the things wrong with perl5 (and I love it dearly but have spent enough time I can probably list more things wrong with it than the people wh…

This happens all the time. The new generation creates something cool because what our parents created isnt cool any more, only to fail exactly on the same spot as our parents. Only, it was already solved in the parents last version. This goes for cloth design, cars, houses, kitchen wares and so on, as well as software. Just look at the microwave oven earlier...

Genuine question... What happened with the microwave oven?

Re: Many packages suddenly disappeared

#465
post #463

Earlier quoted context omitted.

What's the wild-west model? Write it all yourself? "cp -r $dependency_location $install_location"? Genuinely curious.

The "wild west" model is where there is no maintainer or distributor between the developer and consumer that is allowed to perform any sort of quality control or sanitisation. That sounds good from a naive standpoint - who needs this busybody middleman anyway? But the problem is that authors tend not to be great maintainers. Authors can (and do) remove packages at any time, make changes to packages without bumping ve…

>The "wild west" model is where there is no maintainer or distributor between the developer and consumer that is allowed to perform any sort of quality control or sanitisation.

That's not entirely true. Maintainers or distributors aren't required under the "wild-west" model, but that's not the same as anything being disallowed. It's up to the community and the developer to do their own due diligence. The "wild west" model is just the free software model, it's just the lack of some central authority limiting user freedom for the good of the community.

Rather, it's the "distribution" model which forbids anything not approved by the list of official maintainers. All of the problems you list with package authors still exist, but you have fewer options as a developer should they arise.

Re: Many packages suddenly disappeared

#467

Earlier quoted context omitted.

> Because each thing has a constant price in learning effort That's not, in my experience, how it works. Learning your first tool (or language) takes a lot of time. Learning your second is quicker. By the tenth, you're able to learn it by skimming the README and changelog. It works like this for languages too, at least for me. My first "real" language (aside from QBasic) was C++ and it took me 3-4 years to learn it t…

But it does, you're just focusing on the other component of learning. Put another way, for a new tool, learning cost is a sum of a) cost of learning idiosyncrasies of that tool, and b) cost of getting familiar with the concepts used by it. You're talking about b), which is indeed a shared expense. But a), by definition, isn't. And it's always nonzero. And since new tools are usually made to differ from previous ones…

My argument is that the a) part's cost is indeed non-zero, but - contrary to what you say - trivial in a vast majority of cases. It's just my personal experience, but it happened every single time I tried to learn something: learning "what" and "why" took (potentially a lot of) time, but learning "how" was a non-issue, especially if a "quick reference" or a "cheat sheet" was available. I also disagree that the a) part is never shared between tools: there are only so many possible ways of doing things, but a seemingly infinite supply of tools for doing them. The idiosyncrasies are bound to get repeated between tools and, in my experience, it happens pretty often.

As an example, imagine you're learning Underscore.js for the first time. It's a mind-blowing experience, which takes a lot of time because you have to learn a bunch crazy concepts, like currying, partial application, binding, and others. You also have to learn Underscore-specific idiosyncrasies, like the order of arguments passed to the callback functions and the like - mostly because you are not yet aware which things are important to know and which are just idiosyncrasies.

Now, imagine you know Underscore already and have to learn Lo-dash or Ramda.js. As the concepts remain very similar, you only need to learn a few conventions, which are different in Ramda. But! Even then, you don't have to really learn all of them to use the library effectively. It's enough to keep the diff of the Underscore and Ramda conventions in mind: learning that, for example, the order of arguments passed to callbacks differ is enough; you can then check the correct order in the docs whenever you need. You know where to find that piece of information, you know when it matters and, by extension, when it's not a concern. There is no need to waste time trying to learn trivia: not doing something is always going to be the fastest way of doing it. By your second library, you start to recognize trivia and are able to separate it from informations that matter. Learning prelude.ls afterward is going to take literally 30 minutes of skimming the docs.

This is just an example, but it worked like that for me in many cases. When I switched from SVN to Bazaar, for example, it took quite a bit of time to grok the whole "distributed" thing. When I later switched from Bazaar to Git it took me literally an hour to get up to speed with it, followed by a couple more hours - spaced throughout a week or two - of reading about the more advanced features. Picking up Mercurial after that was more or less automatic.

I guess all of this hinges upon the notion of the level of familiarity. While I was able to use bzr, git and hg, it only took so little time because I consciously chose to ignore their intricacies, which I knew I won't need (or won't need straight away). On the other hand, you can spend months learning a tool if your goal is a total mastery and contributing to its code. But the latter is very rarely something you'd be required to do, most of the time the level of basic proficiency is more than enough. In my experience, the cost of reaching such a level of proficiency becomes smaller as you learn more tools of a particular kind.

That's the reason I disagree with your remark that that cost is "constant". It's not, it's entirely dependent on a person and the knowledge they accumulated so far. Learning Flask may take you a week if you're new to web development in Python, but you could learn it in a single evening if you worked with Bottle already. On a higher level, learning Elixir may take you months, but you could also accomplish it in a week, provided that you already knew Erlang and Scheme well.

So that's it - the cost of learning new tools may be both prohibitive and trivial at the same time, depending on a prior knowledge of a learner. The good thing about the "prior knowledge and experience" is that it keeps growing over time. The amount of knowledge you'll have accumulated in 20 years is going to be vast to the extent that's hard to imagine today. At that point, the probability of any tool being genuinely new to you will hit rock bottom and the average cost of switching to another tool should also become negligible.

To summarize: I believe that learning new tools gets easier and easier with time and experience and - while never really reaching 0 - at some point, the cost becomes so low that it doesn't matter anymore (unless you have to switch really often, of course).

Re: Many packages suddenly disappeared

#468

Earlier quoted context omitted.

You're in a really self-selecting crowd then. Less than half the people I know use it, mostly because my social group is outside of the tech world.

Reddit is in the top 10 most popular websites according to Alexa. I'd venture to say most reddit users aren't people in the tech world.

I know exactly one person who uses it. To me it always seemed like 4chan-light.

Re: Many packages suddenly disappeared

#470
post #52
post #44

Btw. for those who don't know: Yarn (which is an alternative to npm) uses a global cache [1] on your machine which speeds things up, but probably also protects you from immediate problems in cases like the one currently on progress (because you would probably have a local copy of e.g. require-from-string available). [1] https://yarnpkg.com/lang/en/docs/cli/cache/

Already counting down the days before yarn is considered old and broken and people are recommending switching to the next hot package manager/bundler...

Already counting down th days before yarn is considerd the new defacto standard package manager...
Post reply on HN