Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM: 429 Too Many Requests

github.com

Post reply on HN
Print view View original

91–100 of 171 posts

Re: NPM: 429 Too Many Requests

#91

Post by gpmcadam »

warpech wrote: post #80
lqs469 wrote: post #76

Earlier quoted context omitted.

It's just a mirror service address, the NPM package is the same. Worrying too much about cybersecurity is a bit of a storm in a teacup.

Well, how do you know it's "just" a mirror service, and it is not using a zero-day to exploit your system, by installing a root-kit or copying your code to their servers? I agree that it's a valid concern.

If you're concerned about injection into a third-party package, you should be using `package-lock.json` (or equiv) and integrity hashing your dependencies at install time.

Re: NPM: 429 Too Many Requests

#92

Post by ilikepi »

Hamuko wrote: post #46
MattRix wrote: post #36

Earlier quoted context omitted.

This is the first time I've seen "&c" used instead of "etc", I had to look it up. Interesting abbreviation!

Why would anyone use "&c" considering that it doesn't actually save any key presses?

How about as a stylistic choice? There are lots of little choices like that one makes when writing that together form a person's individual writing style.

Re: NPM: 429 Too Many Requests

#93

Post by mikehollinger »

hans1729 wrote: post #27
matsemann wrote: post #14

Earlier quoted context omitted.

You say it like it's a bad thing? It's possible to be both professional and have some fun (not talking about the linked GH).

Having fun is not whats discouraged. Rather: if I'm looking for the solution for some problem, I don't want to scroll through memes, because I want to be productive, getting things done. Spam/fog in the resolution-thread obviously doesn't help with that; the opposite is the case.

Basic moderation in some form would be useful there. It’s interesting - there’s not (that I’ve seen anyway) a tremendous amount of spam or for the most part off topic conversations in in github issues. I’ve seen phishing attempts (I think) that seem to be “hey just go download and run curl ____.sh | bash” and you’ll be good to go occasionally but that sort of banter isn’t typical (at least in the circles I run in).

Re: NPM: 429 Too Many Requests

#94

Post by [deleted] »

gmemstr wrote: post #6

This seems to be slowly clearing up. Regardless, can we talk about the conduct in this GitHub thread? I know every community is different but is it common to have memes and jokes posted this quickly and often in a GitHub issue? It makes it really hard to follow and discourages genuinely useful discussion of workarounds or progress.

[deleted]

Re: NPM: 429 Too Many Requests

#95

Post by lidHanteyk »

matsemann wrote: post #14
lm28469 wrote: post #10

Earlier quoted context omitted.

Some people getting in the workforce in the last few years have troubles making the distinction between work and play contexts. It's extremely visible on github, slack, &c. which are more and more looking like discord / reddit (gifs, memes, random jokes in the middle of serious discussions)

You say it like it's a bad thing? It's possible to be both professional and have some fun (not talking about the linked GH).

The problem, specifically, is that folks use humor to mask the fact that they don't know or understand what's going on.

Re: NPM: 429 Too Many Requests

#96

Post by jackewiehose »

joeyrobert wrote: post #82
SirensOfTitan wrote: post #47

I’ve been considering checking node_modules into source control for some time now, has anyone else done that successfully? There would be a variety of benefits: 1. Eliminate redownload of packages on every CI build 2. Reduce the amount of gigantic IO operations from unpacking the tens-of-thousands of files sitting in node_modules. 3. Better security: code checked in can be audited better if not downloaded every singl…

Helps if you only have one platform you're developing on and deploying to (e.g. x86-64 Linux). If developing on macOS there can be Mac specific binaries installed, depending on the package.

And if you do have more platforms, why not just check in one node_modules-directory for each?

This idea to redownload all packages all the time from external sources (and not even having a fallback-plan) seems completely brain-dead to me. Didn't the people learn from leftpad-gate?

Re: NPM: 429 Too Many Requests

#97

Post by vhakulinen »

Sharlin wrote: post #81
vhakulinen wrote: post #62

Earlier quoted context omitted.

> I think the introduction of emoji reactions was a bad idea, it gamifies the issues system. It depends on the community. I've seen many where the reactions are genuine and actually serves a purpose. From what I've seen, its almost always a popular js/node project that attracts this kind if behaviour like seen in this thread (based on my own observations). Last example is vscode's santa hat[1]. It seems that that thr…

JS/Node is the entry-level programming environment of the current era, like PHP used to be, and the community norms (or lack thereof) reflect that.

Your comparison of today's js/node to PHP from 20 years ago is interesting.

I wonder if javascript will be in similar place in 10-20 years that PHP is today (e.g. "its not like it used to be and things a actually quite good now")? The language it self (javascript) might be there already, but is the community anywhere close yet? SQL injections used to be the thing PHP was known for in the past but not so much these days (the community is more experienced?). Meanwhile, problems with NPM and the whole packaging situation is what javascript is known for these days, but will the be so on 20 years?

Re: NPM: 429 Too Many Requests

#98

Post by adonese »

lm28469 wrote: post #10
gmemstr wrote: post #6

This seems to be slowly clearing up. Regardless, can we talk about the conduct in this GitHub thread? I know every community is different but is it common to have memes and jokes posted this quickly and often in a GitHub issue? It makes it really hard to follow and discourages genuinely useful discussion of workarounds or progress.

Some people getting in the workforce in the last few years have troubles making the distinction between work and play contexts. It's extremely visible on github, slack, &c. which are more and more looking like discord / reddit (gifs, memes, random jokes in the middle of serious discussions)

In GH in particular, I’m not sure why images are allowed to be rendered in comments at all. They are almost always harmful. External links can be used instead

Re: NPM: 429 Too Many Requests

#99

Post by bartread »

RL_Quine wrote: post #38
aequitas wrote: post #30

Earlier quoted context omitted.

The countless +1 and "Same here" comments without additonal info are a huge problem as well on Github. A simple click on a +1 button would suffice instead of a full comment. It's especially irritating when you follow a lot of issues hoping to get notified when there is a resolution but instead you get spammed by people making these pointless comments.

It makes it impossible to actually follow critical threads, as the notifications are completely worthless.

Not related to GitHub but the same issue is a pet peeve of mine in Whatsapp and Facebook messenger groups as well. Everything's a message so you end up getting notifications for people sending thumbs up or what have you[1].

It really clutters the conversation so when you're trying to find, e.g., the flight information, or the link to $IMPORTANT_THING, that somebody posted a few days ago you end up scrolling through screens and screens of total guff.

I wish there was a quick way to collapse messages that aren't relevant or useful, and that goes for GitHub issues as well.

[1] Apart from the fact this is distracting, and potentially a nuisance if you're working, driving, whatever, it also drains your phone's battery.

Re: NPM: 429 Too Many Requests

#100

Post by hyperpape »

colonwqbang wrote: post #37

Is it common to rely on a free service like npm for your company's core business? It seems like you would be taking a huge risk by not mirroring anything you need internally.

Anecdata time: I'm in a 300 person (~50 dev) company serving the enterprise space (we have SOC audits). All our NPM and Maven needs are handled through a local Artifactory instance.
Post reply on HN