Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

51–60 of 827 posts

Re: I've Just Liberated My Modules

#51

Post by st3v3r »

aidos wrote: post #29
chvid wrote: post #6

In case anyone is wondering what was in the now broken dependency - here is the source code in full: module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i https://github.com/azer/left-pad/blob/master/index.js

I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste. The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even b…

Should one not be able to unpublish? What if there's a bug in a released version, and it's going to take a while to fix? Or what if you simply no longer wish to be associated with the organization anymore?

Re: I've Just Liberated My Modules

#53

Post by stonemetal »

swang wrote: post #28

Was that lawyer overreaching? I don't know. But for this guy to expect npm to use their resources to defend him (which they may even possibly lose!) and get mad at them is... a bit presumptuous? Github isn't open source either so is he going to get mad when the lawyers send them an email about kik?

If the kik in question is kik.com then

>Are you a developer? Kik has open-sourced tools and libraries to help you create great web experiences that can be discovered and instantly shared by Kik's 240 million users.

Rather sounds like a valid use of the law, not necessarily nice but valid. They are in the same space, open source web development.

Re: I've Just Liberated My Modules

#54

Post by maxaf »

joshmanders wrote: post #45
larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

https://en.wikipedia.org/wiki/Unix_philosophy

Taking an idea to the logical extreme is an effective means of invalidating said idea. How many UNIX utilities are 17 silly lines long?

A bit of code duplication would go a long way towards bringing sanity to JS land.

Re: I've Just Liberated My Modules

#55

Post by mschuster91 »

brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder).

To be honest, I have waited for something like this to happen so that people finally wake up and realize how deeply and truly compromised the JS ecosystem really is. 11 SLOC not available any more and all over the internet builds are breaking etc.?!

And please, why isn't essential stuff like this in the JS standard string library?

Re: I've Just Liberated My Modules

#56

Post by CydeWeys »

jlg23 wrote: post #46
celtain wrote: post #34

Earlier quoted context omitted.

I think you missed the caveat about the actual damage caused. Wasting people's time is nowhere close to murder.

And I think you missed the point of my response. I chose a admittedly drastic picture to get across the point about causing collateral damage.

Hyperbolic analogies don't prove points though.

Re: I've Just Liberated My Modules

#57

Post by Etheryte »

mathetic wrote: post #30
cammsaul wrote: post #8

Update: NPM takes "unprecidented action [...] given the severity and widespread nature of the breakage" and un-un-publishes left-pad https://twitter.com/seldo/status/712414400808755200

This is incredible. They screwed the author about ownership once and then they did exactly the same thing again.

Yes, I was rather neutral at first, but this is a complete dick move on NPM's behalf. Essentially they've just given the module to another owner.

Re: I've Just Liberated My Modules

#58

Post by bentlegen »

krainboltgreene wrote: post #50
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

That's not how it works. You can't publish left-pad 0.0.3 again.

Unless you're npm: https://twitter.com/seldo/status/712414400808755200

Re: I've Just Liberated My Modules

#59

Post by callmevlad »

krainboltgreene wrote: post #50
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

That's not how it works. You can't publish left-pad 0.0.3 again.

Yes, but I can publish an evil left-pad@0.0.10, and if you're not shrinkwrapping or any sub-dependency has left-pad: "^0.0.3", it will pull in the evil 0.0.10 version.

EDIT: I stand corrected. See below, looks that's not the case specifically for "0.0.x" versions, but gets progressively more relaxed if there's a non-zero minor version specified. However, many of the unpublished packages had varying major and minor versions, which would have the more loose caret range behavior.

Re: I've Just Liberated My Modules

#60

Post by steveklabnik »

st3v3r wrote: post #51
aidos wrote: post #29

Earlier quoted context omitted.

I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste. The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even b…

Should one not be able to unpublish? What if there's a bug in a released version, and it's going to take a while to fix? Or what if you simply no longer wish to be associated with the organization anymore?

  > if you simply no longer wish to be associated
  > with the organization anymore?
Given that it's open source, (specifically WTFPL in this case), that's not something you can actually. Or rather, it _is_ okay for npm to republish stuff: that's part of the license.
Post reply on HN