Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM Install Everything, and the Complete and Utter Chaos That Follows

boehs.org

Post reply on HN
Print view View original

1–10 of 20 posts

Re: NPM Install Everything, and the Complete and Utter Chaos That Follows

#4

Post by ghusto »

> “How can this sort of event that makes our customers angry be prevented in the future?”, they asked themselves. Their answer was a new rule: any versions of a package that has dependents cannot be removed from the registry

> We tried to hang a pretty picture on a wall, but accidentally opened a small hole. This hole caused the entire building to collapse.

These two snippets say everything that needs to be said about the JavaScript ecosystem and mentality. I'll leave if for you to decide what that is.

Re: NPM Install Everything, and the Complete and Utter Chaos That Follows

#6

Post by mrgaro »

internetter wrote: post #2

Hi HN!! I’m the author of this, if you have questions let me know

Great work! Package management and supply chain issues are definitely something which have by no means been solved. I appreciate that you did your experiment as it pushes the community forward to think solutions to these problems.

I think you should still build some kind of script to install every available package and then do some interesting analysis from the result. For example I'm sure there are supply chain troijan horses awaiting to be discovered.

Re: NPM Install Everything, and the Complete and Utter Chaos That Follows

#8

Post by clintonb »

ghusto wrote: post #4

> “How can this sort of event that makes our customers angry be prevented in the future?”, they asked themselves. Their answer was a new rule: any versions of a package that has dependents cannot be removed from the registry > We tried to hang a pretty picture on a wall, but accidentally opened a small hole. This hole caused the entire building to collapse. These two snippets say everything that needs to be said abou…

Do they? Someone tried to solve a large problem with the package manager, and inadvertently created a larger problem. That simply indicates the folks at NPM didn't fully think through the edge cases of their problem/solution.

I'm curious if other package managers have the same problem identified by the author, or are susceptible to the "left-pad" problem?

Re: NPM Install Everything, and the Complete and Utter Chaos That Follows

#9

Post by internetter »

mrgaro wrote: post #6
internetter wrote: post #2

Hi HN!! I’m the author of this, if you have questions let me know

Great work! Package management and supply chain issues are definitely something which have by no means been solved. I appreciate that you did your experiment as it pushes the community forward to think solutions to these problems. I think you should still build some kind of script to install every available package and then do some interesting analysis from the result. For example I'm sure there are supply chain troi…

Yeah. We were considering it, obviously that may have been a better way to go about it. I want to return to it in the future and do it this way, but we lost a little interest after all this.
Post reply on HN