6 ms·
blip.strongloop.com is dead – what is this?
- dexwiz 11y agoAnalytics shouldn't break applications. If anything npm should provide a way to opt into analytics and provide them to all publishers.
- kuschku 11y agoEven worse, they’re doing analytics without opt-in, or providing a way to use the package without analytics. This is clearly inacceptable.
- forgottenacc56 11y agoUnacceptable
- kuschku 11y agoSee, this is why I don’t like english. in- and un- both should mean the same, why I can’t I use them synonymously?
- grawlinson 11y agoAll languages have their own idiosyncrasies, not just English. I'm a native speaker of 2 different languages and I find that there is still more to learn about them via small mistakes that I make.
- deleted 11y ago[deleted]
- majormjr 11y agoInflammable means flammable? What a country!
- mchahn 11y agoI'm not sure what country you are talking about. Inflammable means the same in every english-speaking country.
- trav4225 11y agoThe commenter was making a comical reference to Yakov Smirnoff: https://en.wikipedia.org/wiki/What_a_Country https://en.wikipedia.org/wiki/What_a_Country!
- throw_away 11y agoSpecifically, the Simpsons' reference to Yakov Smirnoff: https://www.youtube.com/watch?v=Q8mD2hsxrhQ https://www.youtube.com/watch?v=Q8mD2hsxrhQ
- ntumlin 11y agoI'm aware this is a reference, but for people who didn't know this already, inflammable is like the word inflamed, which doesn't mean "not in flames".
- pfooti 11y agoInfamous means famous! More than famous! https://www.youtube.com/watch?v=GIGtHhAfe8w https://www.youtube.com/watch?v=GIGtHhAfe8w
- striking 11y agoOr, just provide anonymized public analytics.
- davidbanham 11y agoThis isn't npm doing analytics. It's the package manager abusing a dependency declaration and a preinstall script to do their own private analytics.
- robdodson 11y agoSource: https://twitter.com/samccone/status/688809217692545026 https://twitter.com/samccone/status/688809217692545026
- amluto 11y agoOne might reasonably wonder whether executing npm outside a sandbox is a good idea under any circumstances.
- avita1 11y agoBut they can't be stealing any identifying information right? At best it can count the number of times the package was downloaded. Isn't the solution for npm to have tighter controls on where it will download packages from?
- STRML 11y agoIt depends on whether or not it actually delivers a payload. If it does, then it can use a `postinstall` hook to execute absolutely anything it wants, under the context of the user. This is why you should always shrinkwrap and run a private npm repository in production. Anything less is opening you up to remote takeover at the whim of a single package publisher.
- hitekker 11y agoBetween this and the other article regarding the death of ExpressJS-- is IBM is a good contributor to the JS open source community?
- grawlinson 11y agoI quite agree with this comment from Reddit: "I think you nailed it that this is most likely more bureaucracy than malice. IBM is like government. There's no sense of urgency whatsoever." Source: https://www.reddit.com/r/javascript/comments/41dadv/is_express_dying/cz1pm1d https://www.reddit.com/r/javascript/comments/41dadv/is_expre...
- __derek__ 11y agoDid you read the GitHub thread on Express? The project is still very much alive, but its internals have been broken out into standalone packages, so the only commits to Express itself are version updates. That issue was created based on a misunderstanding.
- plorkyeran 11y agoIf you read further down on the Github thread, the guy who did the splitting out is no longer working on the project and it's now fully in IBM's hands, who aren't doing much of anything.
- __derek__ 11y agoI just saw that! I read it a few days ago, but went back to catch up. I came back to edit my comment.
- __derek__ 11y agoThis appears not to be the case, so it's me who's saying things based on misunderstandings now.
- STRML 11y agoThis actually happened well before IBM acquired StrongLoop - I first noticed it in February, but it was added in January 2015. The IBM acquisition was announced in September 2015. In their usual fashion they link to internal bug trackers when committing (without summary), something that has frustrated me greatly while attempting to work with them on strong-remoting and loopback-explorer.
- nodesocket 11y ago`curl -i http://blip.strongloop.com/loopback` http://blip.strongloop.com/loopback` returns content from S3. Are we suggesting then they are using S3 bucket analytics to see how many times a package has been downloaded then?
- deleted 11y ago[deleted]
- brillenfux 11y agoI have long since come to the conclusion that most of the nodejs ecosystem is rotten. I don't even know where to begin. I'm certain this is a mentality issue more than anything.
- pearjuice 11y agoGreed for authority, power and influence is what is causing that rot.
- untog 11y agoI just think that the nodejs ecosystem moves fast. But anything involving StrongLoop/IBM is immediately suspect.
- edwinnathaniel 11y agoJust strongloop is enough. IBM acquihire them and let they do what they have been doing...
- andrewmcwatters 11y agoMost issues are people issues.
- cpeterso 11y agoShould the HN title include "(2015)"? This StrongLoop issue was reported in February 2015.
- STRML 11y agoPerhaps. I opened it a long time ago, but I've still been trying to keep it alive in the hope that somebody from Strongloop will actually comment on it. In the meantime, if you use a Strongloop package, fork it and remove the optionalDependency.