4 ms·

As a counterpoint, couldn't any sufficiently complex structure be called a hack and a house of cards, when you really dig down into how it's put together? Mm, m

As a counterpoint, couldn't any sufficiently complex structure be called a hack and a house of cards, when you really dig down into how it's put together? Mm, maybe not any - as some complex systems are well-tested with solid architecture - but just some, or most..

notatoad 9y ago
A "house of cards" implies that you don't have to dig to topple it. If you have to really dig down into how it's put together in order to start pulling it apart it isn't really a house of cards. I don't use npm or node for anything serious, and i don't really have any knowledge of how NPM works, but this isn't the first time i've read this story of a whole bunch of packages disappearing and everybody's builds breaking. If everything is a house of cards, then why don't i hear the same stories about PyPI or gems or crates?
- lioeters 9y ago
  It reminds me of this article, Everything is Broken. Perhaps a house of cards becomes solid architecture through the test of time..? https://medium.com/message/everything-is-broken-81e5f33a24e1 https://medium.com/message/everything-is-broken-81e5f33a24e1
  - sebazzz 9y ago
    The issues with the NPM Registry are not technical but management issues and decisions not properly thought through.
    - zbentley 9y ago
      As of this writing, aren't we still waiting to see what the problem was inside NPM that caused this user's packages to disappear? It might well have been technical. It might well have been managerial. It very likely involved elements of both. But don't you think it's best to save the Monday morning quarterbacking for Monday morning, when all the facts are in?
- rmrfrmrf 9y ago
  Because when you’re on top, everyone loves seeing you fail. A quick CVE search pulled up 18 vulnerabilities in RubyGems, including remote code execution.
- borntyping 9y ago
  > If everything is a house of cards, then why don't i hear the same stories about PyPI or gems or crates? npm is roughly twice as big as PyPI, RubyGems and crates.io together.
  - heartbreak 9y ago
    Disappearing packages due to a deleted user is not an issue of scale.
- christophilus 9y ago
  I can't speak for PyPI, but I know Ruby gems has had vulnerabilities in the past. A quick DuckDuckGo will probably suffice to demonstrate that. I'm not saying NPM is a great system, but it does seem to me that most systems have flaws, and any system that is as heavily used as NPM is likely to have them surface faster than other systems.
ken 9y ago
"Have you ever noticed that anybody driving slower than you is an idiot, and anyone going faster than you is a maniac?" --George Carlin I think the software version of this is: any system with more structure than your program is an over-engineered monstrosity, and any system with less structure than your program is a flakey hack.

notatoad 9y ago

A "house of cards" implies that you don't have to dig to topple it. If you have to really dig down into how it's put together in order to start pulling it apart it isn't really a house of cards. I don't use npm or node for anything serious, and i don't really have any knowledge of how NPM works, but this isn't the first time i've read this story of a whole bunch of packages disappearing and everybody's builds breaking. If everything is a house of cards, then why don't i hear the same stories about PyPI or gems or crates?

lioeters 9y ago
It reminds me of this article, Everything is Broken. Perhaps a house of cards becomes solid architecture through the test of time..? https://medium.com/message/everything-is-broken-81e5f33a24e1 https://medium.com/message/everything-is-broken-81e5f33a24e1
- sebazzz 9y ago
  The issues with the NPM Registry are not technical but management issues and decisions not properly thought through.
  - zbentley 9y ago
    As of this writing, aren't we still waiting to see what the problem was inside NPM that caused this user's packages to disappear? It might well have been technical. It might well have been managerial. It very likely involved elements of both. But don't you think it's best to save the Monday morning quarterbacking for Monday morning, when all the facts are in?
rmrfrmrf 9y ago
Because when you’re on top, everyone loves seeing you fail. A quick CVE search pulled up 18 vulnerabilities in RubyGems, including remote code execution.
borntyping 9y ago
> If everything is a house of cards, then why don't i hear the same stories about PyPI or gems or crates? npm is roughly twice as big as PyPI, RubyGems and crates.io together.
- heartbreak 9y ago
  Disappearing packages due to a deleted user is not an issue of scale.
christophilus 9y ago
I can't speak for PyPI, but I know Ruby gems has had vulnerabilities in the past. A quick DuckDuckGo will probably suffice to demonstrate that. I'm not saying NPM is a great system, but it does seem to me that most systems have flaws, and any system that is as heavily used as NPM is likely to have them surface faster than other systems.

ken 9y ago

"Have you ever noticed that anybody driving slower than you is an idiot, and anyone going faster than you is a maniac?" --George Carlin I think the software version of this is: any system with more structure than your program is an over-engineered monstrosity, and any system with less structure than your program is a flakey hack.