Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A one-line package broke `npm create-react-app`

github.com

Post reply on HN
Print view View original

461–470 of 478 posts

Re: A one-line package broke `npm create-react-app`

#461

Post by throwanem »

ajxs wrote: post #420
throwanem wrote: post #225

Earlier quoted context omitted.

Yes, that's largely my point. I'm not sure why it is surprising to see an ecosystem, twenty-five or so years younger than the one I compared it to, have the same problems as that one did twenty-five years or so ago.

Pardon me if I've misunderstood you. I feel that this line of reasoning that excuses modern Javascript's mistakes on the basis of it being a young language to be spurious. We don't need to engineer new languages that recreate the mistakes of previous ones, or even worse, commit entirely new sins of their own. It's not like no-one saw the problems of the Node/JS ecosystem, or the problems of untyped languages, coming…

Okay, then, argue it.

Re: A one-line package broke `npm create-react-app`

#463

Post by qes »

chvid wrote: post #422
mikewhy wrote: post #309

Earlier quoted context omitted.

Not sure where you're getting 1h12 from. First issue was reported at 12:18pm (my time) final update that fixed it was published at 3:08pm. Not that long, but my issue with this release snafu is that: - the build didn't pass CI in the first place - the CI config wasn't updated to reflect the most recent LTS release of node - the update happened directly to master (although that's to how the maintainer wants to run the…

This is a good example of how terrible messy JavaScript library creation is. There is no change to the actual functionality of the library. Only in the way it is packaged, here to support something that is an "experimental" feature in node. It is also something that is hard to write automated tests for.

> This is a good example of how terrible messy JavaScript library creation is.

Meanwhile over in .Net-land, after 15+ years of smooth sailing (5+ if you only count from the introduction of NuGet), the transition from full framework to .Net Core has made a multi-year long migraine out of packaging and managing dependencies.

I ran into multiple scenarios where even Microsoft-authored BCL packages were broken and needed updates to resolve only packaging issues. It's a lot better now than during v1.x days, but I still have hacks in my builds to work around some still broken referencing bits.

Re: A one-line package broke `npm create-react-app`

#464

Post by foepys »

exogen wrote: post #458
foepys wrote: post #410

Earlier quoted context omitted.

GP's comment screams XY problem which seem to be increasingly common these days.

If you think pointing out a bug due to an edge case someone didn't think of is the XY problem, I'm afraid you don't know what the XY problem is.

The problem was to get the promise out of the iframe when you shouldn't do this directly in the first place.

This literally is an XY problem: "I need to do A but it's giving me bad results, what do I need to add?" - "Don't use A, it's bad practice. Use B instead and keep using built-in tools instead of hacking something together" In this case use instanceof instead of is-promise because it's a hack around the actual problem of getting objects out of a different context that was explicitly designed to behave this way.

I'm afraid that you don't know what an XY problem is.

JavaScript developers always seem to think they are the smart ones after their 6 weeks of some random bootcamp and then you end up with some crap like NPM where a single line in a package out of hundreds maintained by amateurs can break everybody's development environment.

Re: A one-line package broke `npm create-react-app`

#465

Post by joepie91_ »

habosa wrote: post #431

I am one of the maintainers of a popular Node-based CLI (the firebase CLI). This type of thing has happened to us before. I think the real evil here is that by default npm does not encourage pinned dependency versions. If I npm install is-promise I'll get something like "^1.2.1" in my package.json not the exact "1.2.1". This means that the next time someone installs my CLI I don't know exactly what code they're getti…

> If I npm install is-promise I'll get something like "^1.2.1" in my package.json not the exact "1.2.1". This means that the next time someone installs my CLI I don't know exactly what code they're getting (unless I shrinkwrap which is uncommon).

Yes, this is by design. If this weren't the case, the ecosystem would be an absolute minefield of non-updated transitive dependencies with unpatched security issues.

Re: A one-line package broke `npm create-react-app`

#467

Post by exogen »

foepys wrote: post #464
exogen wrote: post #458

Earlier quoted context omitted.

If you think pointing out a bug due to an edge case someone didn't think of is the XY problem, I'm afraid you don't know what the XY problem is.

The problem was to get the promise out of the iframe when you shouldn't do this directly in the first place. This literally is an XY problem: "I need to do A but it's giving me bad results, what do I need to add?" - "Don't use A, it's bad practice. Use B instead and keep using built-in tools instead of hacking something together" In this case use instanceof instead of is-promise because it's a hack around the actual…

> when you shouldn't do this directly in the first place.

There's absolutely nothing wrong with accessing the content of a same-origin iframe.

I am sorry that you cannot admit to being wrong.

> after their 6 weeks of some random bootcamp

I have a Computer Science degree and 20 years of web development experience, long before npm existed. So fuck off.

Re: A one-line package broke `npm create-react-app`

#468

Post by overgard »

rubyn00bie wrote: post #363
overgard wrote: post #229

Earlier quoted context omitted.

Unless the packages you're adding are trivial I seriously doubt you're looking that close. Are you really going to code review 20000 lines of someone elses code every time you're adding something? 100,000? Also their dependencies? Those are very reasonable numbers by the way.

I said I look at them, I didn't say I inspect every single line of them. My point, which you've missed, is that simply looking at the code before you add it (spend a even a couple minutes) saves a lot of problems (like the one in create-react-app). FWIW, I also won't add something to my project if I see it has a ton of dependencies on stupid shit. Literally, I gave up on react after realizing `create-react-app` is wh…

If you don't read the source, how can you claim such moral superiority? Whatever security issues, nefarious code, etc., are almost assuredly hidden down in the weeds where you're not looking. You think other programmers don't glance at the structure? Of course they do.

Re: A one-line package broke `npm create-react-app`

#470

Post by Aeolun »

yellowapple wrote: post #444
Aeolun wrote: post #427

Earlier quoted context omitted.

It should be fairly simple to look up people describing themselves as developers in the census data I think?

Does the census actually track that? I just did the questionnaire last night online and it didn't ask me anything about my occupation. Or did you mean something other than the US Census (e.g. GitHub or Stack Overflow or LinkedIn profiles)?

No, I meant the US census (or whatever national census), I didn’t actually check if they asked that since it seemed like such a basic thing :/ sorry.
Post reply on HN