Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Left-Pad (2024)

azerkoculu.com

Post reply on HN
Print view View original

71–80 of 224 posts

Re: Left-Pad (2024)

#71

Post by bsenftner »

coffeebeqn wrote: post #59
skrebbel wrote: post #7

Earlier quoted context omitted.

Ok fair! In that case I actually agree with his stance I think. I can understand how isaacs messed this up in what must've been a stressful situation, but it's hard to blame the author for it indeed, if he was just running the commands provided.

I mean if you’re the CEO of a package manager then you should probably have thought that one through a little bit more? Maybe ask one of the engineers what would happen?

"CEO of a package manager" sounds like a 15 year old, and from their behavior was just an old 15 year old.

Re: Left-Pad (2024)

#72

Post by tkiolp4 »

lvl155 wrote: post #65

I remember this incident and it is one of many reasons I was turned off by the entire JS ecosystem.

How come this is related to JS only? Like, if I own a python/rust/go/whatever public package named XYZ and later a company named XYZ forces me to release the package because of trademark issues, and I cannot do but obey, all my packages may run the same luck, so anybody relying on them would be screwed.

I don’t see how the size of the package matters here.

Re: Left-Pad (2024)

#73

Post by tkiolp4 »

iLoveOncall wrote: post #49

> Left-pad was like a "death" and "re-birth" moment for me. The part of me passionate about open-source was dead, and something new took over. Now, I'm passionate about business, marketing, running companies / teams Wow, I couldn't think of a worse rebirth.

Because those things don’t align with what you value? Of course.

Re: Left-Pad (2024)

#74

Post by freehorse »

IshKebab wrote: post #34
shellac wrote: post #16

It's a minor thing, but: > Most of my open source work followed Unix philosophy, so the packages did one thing at a time. Nobody has suggested that libc -- to take the most obvious example -- is against the Unix philosophy. Debates occur around whether whether commands / daemons do too much (recent poster child being systemd) or aren't composable.

The "unix philosophy" is a useless philosophy - perhaps worse than useless even - because "one thing" is not well defined, so in practice it adds nothing and just leads to arguments. You could say that Eclipse does "one thing" - being an IDE platform - but I don't think anyone thinks that's what the Unix devs meant. Similarly I don't think they meant for people to write libraries that contain one 11-line function. Th…

> because "one thing" is not well defined

That's what a philosophy is, gives you some general guideline and you have to use your thinking to figure out how to apply it in specific circumstances. It does not substitute that thinking neither does it prevent stupid choices, it helps guide you in a higher/strategic level. It is not responsible for people making stupid decisions.

Re: Left-Pad (2024)

#75

Post by npn »

bartread wrote: post #46
nindalf wrote: post #19

> I have to admit that I don't understand half of this blog post It's because you haven't read al-Ghazali yet. (definitely the most pompous and self-important part of this post)

> Not driven by logic, anger... I don't know that I fully buy this either, at least not the anger part. I can look back on all this with wry amusement nowadays but I remember it being pretty frustrating at the time. It sort of felt like, well, either you knew what the impact of unpublishing all your packages would be and you did it anyway, which makes you kind of antisocial, or you didn't know what the impact would b…

[flagged]

Re: Left-Pad (2024)

#76

Post by junon »

dontlaugh wrote: post #35
junon wrote: post #20

Maintainer of a few top-10 npm packages here. This makes complete sense. Somewhere along the way NPM stopped being cooperative with the community. It cemented itself with the Microsoft acquisition, but was obvious quite a bit before that. There were so many cracks with how npm functioned, they weren't cooperating well with the community / mainline Node team, their push to commercial viability was really off-putting a…

It wasn’t the first package manager for a programming language and plenty of us pointed out the folly of packages that small. Npm (and JS in general) is a victim of fashion, primarily.

That isn't what I was claiming. I was drawing attention to it being super early on in an ecosystem, in an industry where lots of the "package manager best practices" are now formed based on Node's small-package qualms.

Re: Left-Pad (2024)

#77

Post by rootlocus »

HPsquared wrote: post #24
nicou wrote: post #4

Earlier quoted context omitted.

For context, see https://en.wikipedia.org/wiki/Npm_left-pad_incident

11 lines of code! Wow. I had no idea it was that small.

> Most of my open source work followed Unix philosophy, so the packages did one thing at a time. There was 350+ of them.

The man page for a unix binary is at least two orders of magnitude larger. At some point, the "Unix philosophy" doesn't make sense anymore. I mean, it couldn't even rightpad.

Re: Left-Pad (2024)

#78

Post by hoppp »

jmillikin wrote: post #51
q3k wrote: post #37

Earlier quoted context omitted.

Arguably the root problem was lack of user namespacing; the incident would have been less likely to happen in the first place if the packages in question were named "~akoculu/left-pad" and "~akoculu/kik".

That's right and probably a lot less people would have used left-pad because it looks like a package for a specific org.

Re: Left-Pad (2024)

#79

Post by msla »

k__ wrote: post #70
IggleSniggle wrote: post #63

Earlier quoted context omitted.

The 3rd option is the one Azer describes in the post: He wants to remove his stuff, but isn't sure what the right way to do it is, so he asks npm. npm provides him with a set of scripts to run to remove his stuff, and he, presuming that it's "ok" if npm told him to go ahead and run them, runs them. The impact isn't especially important to him, But since npm just gave him a set of scripts with an implicit "oh okay you…

What would the alternative have looked like? If NPM would have prevented the depublishing, he would have made a scene and in the worst case, they would have looked bad. How they actually handled it, the library author got full freedom but also full responsibility

At a certain point, no, you can't unpublish because the world only has one arrow of time. Imagine if Torvalds decides to unpublish his code in the Linux kernel. It's easy to understand how that would work: His code would remain out there for all time because doing anything else would be a massive disruption and cause people actual problems. People don't just give others a way to hurt them like that if they know what they're doing, even if they got a lot of value from them in the past.

Lesson: Vendor your dependencies, I guess. Although a lot of the ire around left-pad was programmers using a library for something so trivial, but that's a different conversation.

Re: Left-Pad (2024)

#80

Post by ThinkBeat »

HPsquared wrote: post #24
nicou wrote: post #4

Earlier quoted context omitted.

For context, see https://en.wikipedia.org/wiki/Npm_left-pad_incident

11 lines of code! Wow. I had no idea it was that small.

oh there are thousands of those out there on npm. Short and trivial code. Even if you do not use them at all in your own codebase chances are quite high that some package you do use, uses some of those tiny packages.
Post reply on HN