5 ms·

`sudo npm install -g` is one of several examples of the normalization of deviance rife in the NodeJS community. Most command-line utilities distributed through

`sudo npm install -g` is one of several examples of the normalization of deviance rife in the NodeJS community. Most command-line utilities distributed through NPM recommend running as root (implicitly—because they all suggest installing it as a global package). Here's[1] Microsoft's instructions to install the TypeScript compiler, for example. NPM's awfulness notwithstanding, it's trivial to write a shell script to do what you say and add a symlink to ~/bin. But everyone on StackOverflow will tell each other "just run it with sudo", and they do, and then quickly move on with their lives (presumably to be followed with "and break things"). Instead of doing the right thing, raising their hackles about how poorly NPM is designed, and holding its community leaders accountable. 1. https://github.com/Microsoft/TypeScript/blob/b29e0c9e3ab247199eed6b69674a2c992c3a05a6/README.md#installing https://github.com/Microsoft/TypeScript/blob/b29e0c9e3ab2471...

CJefferson 9y ago
If I run npm without -g, it complains about missing files, and fills my home directory with node_modules junk and a package-lock.json I have to "commit"? Why do I want to commit it, and where? I'm sure you are now going to tell me there is an easy way to fix that too, and I'd be happy if there was, but for me I just want to use npm to install a program or two.
- carussell 9y ago
  > for me I just want to use npm to install a program or two. I don't think you're introducing new information. When I wrote my original comment, it was intended to fully acknowledge that this is what's at play. And rereading it, seems like it does that well enough, but I might be wrong. But in any case, I'll run it with sudo then, is absolutely the wrong thing to do, regardless of the bad choices on NPM's part—on par with I just want to use my online banking, so I'll click through this certificate error, or I just want to take some notes, so I'll grant this mobile app the full permissions it's asking for. There's a reason I used the phrase "normalization of deviance". It's a phrase that came out of post mortem investigations into simple process failures at NASA that led to proper (catastrophic, life-ending) failures, and an urge to find an answer to the question, "how in the world did we get here?"
- plorkyeran 9y ago
  The correct way is to use `npm install -g --prefix` to install it into a directory on your path which is writeable by your current user. I don't think I've ever seen the install instructions for a npm-packaged tool actually say to do this.
  - CJefferson 9y ago
    Thanks, I'll give that a try in future.
joshuacc 9y ago
I'm mostly a Windows user, so maybe I'm misunderstanding *nix stuff here, but I don't see how recommending npm i -g package is remotely the same as recommending sudo npm. Could you clarify?
- josteink 9y ago
  On Linux you can’t install globally without sudo. Unlike on Windows global means system global, not user-global. Such a thing does simply not exist for Linux’s npm. If they fixed that, 99% of these issues would go away. This is actually an example of something from the node universe working better on Windows.
  - STRiDEX 9y ago
    > On Linux you can’t install globally without sudo. thats not right. you've just got npm setup wrong. https://docs.npmjs.com/getting-started/fixing-npm-permissions https://docs.npmjs.com/getting-started/fixing-npm-permission...
slavik81 9y ago
~/bin is not in the PATH for many systems. So, if you want beginners to be able to use your program, you'd have to provide instructions on how to change the PATH on each platform that requires it. Then you have to hope that they don't accidentally screw anything up in their profile scripts while making the changes, as I did back when I was new to Linux. It's extra-frustrating writing those instructions, because not only are they platform-specific, but they are different depending on what the user has already done to their system. If some other tool told them to create ~/.bash_profile or ~/.bash_login, the more shell-agnostic option of modifying ~/.profile will no longer work. Figuring out where to change the PATH is also confusing, and you might come across solutions that seem to work, but cause weird errors later down the road. For example, the tool being unavailable when invoked remotely, because you only changed the PATH for interactive shells. It's understandable that people use sudo when they don't see it causing any obvious problems. Installing user-local packages should be one simple command, and it's a failure of operating systems and package managers that it's not. As it stands, correct usage is much harder than incorrect usage, and this is the result.
- cesarb 9y ago
  Newer distributions seem to have standardized on always having ~/.local/bin on the PATH, so this particular problem should be solved in a few years.
kaylynb 9y ago
You can just install packages as part of dev dependencies. You can then run them manually from `node_modules/.bin` or with npm-run, and most tools will pickup the local deps. No need to install anything globally with NPM.

CJefferson 9y ago

If I run npm without -g, it complains about missing files, and fills my home directory with node_modules junk and a package-lock.json I have to "commit"? Why do I want to commit it, and where? I'm sure you are now going to tell me there is an easy way to fix that too, and I'd be happy if there was, but for me I just want to use npm to install a program or two.

carussell 9y ago
> for me I just want to use npm to install a program or two. I don't think you're introducing new information. When I wrote my original comment, it was intended to fully acknowledge that this is what's at play. And rereading it, seems like it does that well enough, but I might be wrong. But in any case, I'll run it with sudo then, is absolutely the wrong thing to do, regardless of the bad choices on NPM's part—on par with I just want to use my online banking, so I'll click through this certificate error, or I just want to take some notes, so I'll grant this mobile app the full permissions it's asking for. There's a reason I used the phrase "normalization of deviance". It's a phrase that came out of post mortem investigations into simple process failures at NASA that led to proper (catastrophic, life-ending) failures, and an urge to find an answer to the question, "how in the world did we get here?"
plorkyeran 9y ago
The correct way is to use `npm install -g --prefix` to install it into a directory on your path which is writeable by your current user. I don't think I've ever seen the install instructions for a npm-packaged tool actually say to do this.
- CJefferson 9y ago
  Thanks, I'll give that a try in future.

joshuacc 9y ago

I'm mostly a Windows user, so maybe I'm misunderstanding *nix stuff here, but I don't see how recommending npm i -g package is remotely the same as recommending sudo npm. Could you clarify?

josteink 9y ago
On Linux you can’t install globally without sudo. Unlike on Windows global means system global, not user-global. Such a thing does simply not exist for Linux’s npm. If they fixed that, 99% of these issues would go away. This is actually an example of something from the node universe working better on Windows.
- STRiDEX 9y ago
  > On Linux you can’t install globally without sudo. thats not right. you've just got npm setup wrong. https://docs.npmjs.com/getting-started/fixing-npm-permissions https://docs.npmjs.com/getting-started/fixing-npm-permission...

slavik81 9y ago

~/bin is not in the PATH for many systems. So, if you want beginners to be able to use your program, you'd have to provide instructions on how to change the PATH on each platform that requires it. Then you have to hope that they don't accidentally screw anything up in their profile scripts while making the changes, as I did back when I was new to Linux. It's extra-frustrating writing those instructions, because not only are they platform-specific, but they are different depending on what the user has already done to their system. If some other tool told them to create ~/.bash_profile or ~/.bash_login, the more shell-agnostic option of modifying ~/.profile will no longer work. Figuring out where to change the PATH is also confusing, and you might come across solutions that seem to work, but cause weird errors later down the road. For example, the tool being unavailable when invoked remotely, because you only changed the PATH for interactive shells. It's understandable that people use sudo when they don't see it causing any obvious problems. Installing user-local packages should be one simple command, and it's a failure of operating systems and package managers that it's not. As it stands, correct usage is much harder than incorrect usage, and this is the result.

cesarb 9y ago
Newer distributions seem to have standardized on always having ~/.local/bin on the PATH, so this particular problem should be solved in a few years.

kaylynb 9y ago

You can just install packages as part of dev dependencies. You can then run them manually from `node_modules/.bin` or with npm-run, and most tools will pickup the local deps. No need to install anything globally with NPM.