5 ms·
What we need is a JS developer to take down an important package from NPM in protest, thus breaking the Internet again.
by Aozi 7y ago
What we need is a JS developer to take down an important package from NPM in protest, thus breaking the Internet again.
- byte1918 7y agoThe NPM fiasco should no longer be possible If you want to unpublish a package after 72 hours have passed, contact npm Support. For more information about why we don’t allow users to unpublish packages after 72 hours, see our unpublish policy. https://docs.npmjs.com/unpublishing-packages-from-the-registry https://docs.npmjs.com/unpublishing-packages-from-the-regist...
- celticninja 7y agoCould you just publish garbage instead?
- yoz-y 7y agoYou could but everybody uses version pinning in production, right?
- emsy 7y agoPeople who are serious about reproducible builds host their own repos. Most people probably don’t know the difference between ^1.0.1 and ~1.0.1
- bakuninsbart 7y agoThanks for making me look that up!
- delfinom 7y agoIf only npm's version pinning actually version pinned without idiotic subrules. package-lock.json is just one massive lie.
- minitech 7y agoWhat do you mean?
- jpangs88 7y agoVersioned garbage, but yeah you could. It would just make a new version not work which isn't as harmful as taking away a package.
- leppr 7y agoIt was never possible without "admin" intervention. That whole inccident was NPM's sole responsibility.
- Crinus 7y agoNot sure how npm works in detail, doesn't it pull directly from devs' repositories? In that case can't the devs just publish an update that breaks everything?
- julianwachholz 7y agoThis wouldn't be as big of a problem with version pinning.
- parsimo2010 7y agonpm allows for installation of specific versions. So even if a dev publishes a new version that breaks you can select a previous version known to work. A good dev shouldn’t be updating willy-nilly to the latest version just because it’s the latest. They ought to spec a particular version and update after testing.
- monocasa 7y agoDoesn't npm allow a dev to replace or redact already released versions?
- precisioncoder 7y agoDoesn't the code still technically belong to you? Can't you submit a takedown request?
- jrockway 7y agoIt belongs to you but you distributed it with a license that gives away some of your rights.
- dang 7y agoWe detached this subthread from https://news.ycombinator.com/item?id=21190597 https://news.ycombinator.com/item?id=21190597 and marked it off-topic.