3 ms·

so, where are the packages stored? how is this more secure than npm? how does this solve the leftpad problem?

nailer 10y ago
leftpad was a social issue. It's been solved by policy on the registry side stopping packages depended on by many others being unpublished.
- ag_dubs 10y ago
  actualyl at this point, unless there is a legal request or a serious security issue, we don't allow any unpublishes. we encourage transferring the package to the npm user and deprecating it. yay immutable registry!
  - steveklabnik 10y ago
    It is unclear why this is downvoted: this is an npm employee who made the requisite policy changes after left pad happened. http://blog.npmjs.org/post/141905368000/changes-to-npms-unpublish-policy http://blog.npmjs.org/post/141905368000/changes-to-npms-unpu...
- pluma 10y ago
  If by "social" you mean bad decisions on settling a naming dispute, yes it was a social issue. That issue hasn't really been addressed publicly (the official policy still doesn't specify how disputes are decided by npm when no amicable agreement can be reached -- other than what essentially boils down to "we'll do what we feel is right"). The actual disruption however was solved by npm Inc disabling unpublishing (except for some very specific circumstances) and by creating a dummy account unpublished modules are reassigned to to avoid abuse (whereas previously anyone could simply claim unpublished modules and publish new versions).
  - nailer 10y ago
    > If by "social" you mean bad decisions on settling a naming dispute, yes it was a social issue. No, I mean someone retroactively removing a package others were using out of spite.
philsnow 10y ago
I think it's more secure because you can deliver to it ("somehow") a global cache of packages. For e.g. Facebook, I bet they have some online filesystem like NFS or similar, that hosts the global yarn cache for their continuous integration system. This way, their CI system doesn't call out to the cloud for every build.
prodigal_erik 10y ago
leftpad wasn't a problem, it was a warning that blindly updating your dependencies without acceptance testing is a problem.
dchest 10y ago
Lock file contains hashes of packages, so it works like many "trust on first use" systems (e.g. SSH): if you installed leftpad@0.2.3, you can be sure that futher installations of this same package will be exactly the same — if malicious npm server gives you something else, this should be detected and rejected. Looks like they use SHA-1 hashes, though. Please, let's get rid of SHA-1 already.

leftpad was a social issue. It's been solved by policy on the registry side stopping packages depended on by many others being unpublished.

ag_dubs 10y ago
actualyl at this point, unless there is a legal request or a serious security issue, we don't allow any unpublishes. we encourage transferring the package to the npm user and deprecating it. yay immutable registry!
- steveklabnik 10y ago
  It is unclear why this is downvoted: this is an npm employee who made the requisite policy changes after left pad happened. http://blog.npmjs.org/post/141905368000/changes-to-npms-unpublish-policy http://blog.npmjs.org/post/141905368000/changes-to-npms-unpu...
pluma 10y ago
If by "social" you mean bad decisions on settling a naming dispute, yes it was a social issue. That issue hasn't really been addressed publicly (the official policy still doesn't specify how disputes are decided by npm when no amicable agreement can be reached -- other than what essentially boils down to "we'll do what we feel is right"). The actual disruption however was solved by npm Inc disabling unpublishing (except for some very specific circumstances) and by creating a dummy account unpublished modules are reassigned to to avoid abuse (whereas previously anyone could simply claim unpublished modules and publish new versions).
- nailer 10y ago
  > If by "social" you mean bad decisions on settling a naming dispute, yes it was a social issue. No, I mean someone retroactively removing a package others were using out of spite.

philsnow 10y ago

I think it's more secure because you can deliver to it ("somehow") a global cache of packages. For e.g. Facebook, I bet they have some online filesystem like NFS or similar, that hosts the global yarn cache for their continuous integration system. This way, their CI system doesn't call out to the cloud for every build.

prodigal_erik 10y ago

leftpad wasn't a problem, it was a warning that blindly updating your dependencies without acceptance testing is a problem.

dchest 10y ago

Lock file contains hashes of packages, so it works like many "trust on first use" systems (e.g. SSH): if you installed leftpad@0.2.3, you can be sure that futher installations of this same package will be exactly the same — if malicious npm server gives you something else, this should be detected and rejected. Looks like they use SHA-1 hashes, though. Please, let's get rid of SHA-1 already.