6 ms·

1000% this. The lodash library for Javascript had the authoritarian dictatorship extreme version of this for the longest time. Any issue was immediately closed

1000% this. The lodash library for Javascript had the authoritarian dictatorship extreme version of this for the longest time. Any issue was immediately closed and only closed issues would be reopened if enough people gave said closed issue enough thumbs up (and "enough" wasn't even defined). And of course, this process wasn't explained anywhere except in replies to closed issues. The obvious problem with this was that no issues were ever acted upon ever because no one ever looked at closed issues, because why would they? I had created a proposal for a new function to be added that was and still is sorely missing. After it was closed and a long discussion ensued between many devs, I gave up and a year later I simply replied that I retract the proposal due to the ridiculous policy of actively being hostile to users. The maintainer deleted the whole issue and along with it all proof of their hostility and hypocrisy. It was then that I decided I would boycott lodash and simply use better libraries in my projects now like Ramda, which is actually OSS. Looks like lodash is now no longer maintained and has hundreds of tickets open after the hostile maintainer (and it's not hard to guess who from looking at the commit counts) appears to have stopped maintaining it. Funny how that works, closing tickets constantly ensures no one will want to help, and then the maintainers feel overwhelmed because they are doing it alone. Basically closing issues is an awful practice that helps no one, as you say.

goldenkey 5y ago
Don't forget that Lodash was basically JDalton's rip of Underscore.js. There used to be a mention of it, since the selling point was benchmarks. Now, I don't see any mention of Underscore...
- capableweb 5y ago
  Not sure I'd call it a "rip", "ripping" for me is associated with "ripping media" which is copying video/music/data from CDs to local hardware. Lodash is more of a re-implementation of a MIT library, not something that should be shameful. As I remember it, Lodash biggest difference was its modular approach also, not all about performance. Lodash also addressed some inconsistencies in Underscore.js.
  - dorian-graph 5y ago
    > "ripping" for me is associated with "ripping media" which is copying video/music/data from CDs to local hardware For many others, the OP's use is common and correct—in a lot of areas. "They ripped me off" is very prevalent in English speaking countries too, outside of tech.
    - capableweb 5y ago
      Yeah, that's my understanding as well, from "ripped me off", implying stealing or something negative. Having the (almost) same API surface as another MIT library is hardly a "ripoff" but a re-implementation. Edit: since new evidence has come forward (https://news.ycombinator.com/item?id=27275379 https://news.ycombinator.com/item?id=27275379) I think we can all agree that Lodash is a fork of Underscore.js, nothing more and nothing else.
  - goldenkey 5y ago
    Allowed or legal doesn't imply couth. As far as I can tell, Lodash no longer mentions Underscore anywhere. This seems wrong..as if one wants to look more original than one actually is. I have no qualms with forks or reimplementations (ie. Android - Java.) I actively support the paradigm. But in this case, it's pretty shitty to try to erase all evidence of said inspiration. Most forks and reimplementations don't do that. They pay homage to their origin with at least a shout out.
    - capableweb 5y ago
      I don't think Lodash ever "credited" Underscore.js for it's origin. Lodash used to have a "compat" version that promised to work the same as Underscore.js but with better performance, but I think that's about it. After some digging, it seems like the Lodash website stopped mentioning Underscore.js around 2015 sometime, but even before that, it never had "evidence of said inspiration" as claimed by you. Here are the versions I looked at: - https://web.archive.org/web/20120826202523/http://lodash.com/ https://web.archive.org/web/20120826202523/http://lodash.com... - https://web.archive.org/web/20130502014523/http://lodash.com/ https://web.archive.org/web/20130502014523/http://lodash.com... - https://web.archive.org/web/20140517192947/http://lodash.com/ https://web.archive.org/web/20140517192947/http://lodash.com... - https://web.archive.org/web/20150513014815/https://lodash.com/ https://web.archive.org/web/20150513014815/https://lodash.co... - https://web.archive.org/web/20160803063412/https://lodash.com/ https://web.archive.org/web/20160803063412/https://lodash.co... - https://web.archive.org/web/20170830163720/https://lodash.com/ https://web.archive.org/web/20170830163720/https://lodash.co... - https://web.archive.org/web/20180703043557/https://lodash.com/ https://web.archive.org/web/20180703043557/https://lodash.co... - https://web.archive.org/web/20190803030353/https://lodash.com/ https://web.archive.org/web/20190803030353/https://lodash.co... - https://web.archive.org/web/20200615092636/http://lodash.com/ https://web.archive.org/web/20200615092636/http://lodash.com... - https://web.archive.org/web/20210314233141/https://lodash.com/ https://web.archive.org/web/20210314233141/https://lodash.co...
- hinkley 5y ago
  How is underscore these days? Lodash as an npm module is out of control, file-size wise, and I'm not sure I'm really getting anything for it, other than once a year having to make sure we don't have ten copies of it that can't be deduped (Currently it's occupying 29MB of disk space on my production machines)
achempion 5y ago
You could try to look on in from another perspective. The library is free and worked on by maintainers in a spare time from main duties (not talking here about lodash specifically). Maintainers don't own you any support nor obliged to work the way you may think they should. I would say that it's great that we have many tools and should give more respect to maintainers which basically save you a ton of resources and maximum they ask for is to follow the established processes.
- deleted 5y ago
  [deleted]
- NetOpWibby 5y ago
  You haven’t addressed the hostile attitude of the maintainer, which was the point.
  - a1369209993 5y ago
    The hostile and deceptive attitude of the maintainer. If they honestly admitted that they didn't give a crap about bug reports, or even just didn't bother setting up any system for recieving them, that would disappointing, but achempion's comment would cover the situation nicely. The problem (assuming the previously stated facts are accurate) is they actively set up a system to solicit and recieve bug reports, and then systematically sabotaged and neglected that system when people tried to actually report bugs.
  - hinkley 5y ago
    I feel like we could have the same conversation about the Docker folks and so this feels more like a popularity contest than an objective conversation.
    - CRConrad 5y ago
      It's not as if "Person or group B are also objectively arseholes!" logically invalidates "Person or group A are objectively arseholes", is it?
Qub3d 5y ago
Also known as the "Cascade of Attention Deficit Teenagers" (CADT) development model: https://archive.is/l4svG https://archive.is/l4svG (jwz link, so archive.is)
Rompect 5y ago
I never understood how people used lodash. Basically every function can be copied and just inserted into ones own codebase and you have one less dependency, which is very pleasant. And they are all so simple that there will never be a problem.
- meetups323 5y ago
  > And they are all so simple that there will never be a problem. "Simple JS can't have unexpected security/performance pitfalls". Hah. https://www.cvedetails.com/vulnerability-list.php?vendor_id=20100&product_id=57083&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=4&sha=ec99d3827329b3d01f3412ca337b0d88dfbde6dc https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
  - no_wizard 5y ago
    Disclaimer: I am not a security expert! This is my layman's attempt at mentioning a common vulnerability too many programs have but not enough knowledge is spread about it. It's easy enough to mitigate in most apps but I don't think most do. I know this isn't directly related, however one of the vulnerabilities is prototype pollution [0], a deceptively simple technique that I think so many apps are vulnerable to. It goes like the following: - Get an application to serialize or take `__proto__`, `constructor` or `prototype` as an input so it's a key on a JS Object - Serialize its value to something nasty, like `'{"auth": {"name": "user", "password": "pwd"}, "message": { "text": "", "__proto__": {"canDelete": true}}}'` [1] This high jacks the prototype of the object and adding those specified properties. If you do things like deep merging of objects on data, you are susceptible to this without the proper guards in hydration / rehydration. The mitigation is simple: don't allow objects to have `constructor`, `prototype`, or `__proto__`. You can delete them by customizing JSON.parse (by passing a reviver [2]) or using something like `mergeWith` to skip these keys A similar vulnerability exists with `constructor` and `prototype` as well [3] [0]: https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications https://portswigger.net/daily-swig/prototype-pollution-the-d... [1]: https://github.com/Kirill89/prototype-pollution-explained https://github.com/Kirill89/prototype-pollution-explained [2]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/parse#syntax https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... [3]: https://shieldfy.io/security-wiki/prototype-pollution/introduction-to-prototype-pollution/ https://shieldfy.io/security-wiki/prototype-pollution/introd...

goldenkey 5y ago

Don't forget that Lodash was basically JDalton's rip of Underscore.js. There used to be a mention of it, since the selling point was benchmarks. Now, I don't see any mention of Underscore...

capableweb 5y ago
Not sure I'd call it a "rip", "ripping" for me is associated with "ripping media" which is copying video/music/data from CDs to local hardware. Lodash is more of a re-implementation of a MIT library, not something that should be shameful. As I remember it, Lodash biggest difference was its modular approach also, not all about performance. Lodash also addressed some inconsistencies in Underscore.js.
- dorian-graph 5y ago
  > "ripping" for me is associated with "ripping media" which is copying video/music/data from CDs to local hardware For many others, the OP's use is common and correct—in a lot of areas. "They ripped me off" is very prevalent in English speaking countries too, outside of tech.
  - capableweb 5y ago
    Yeah, that's my understanding as well, from "ripped me off", implying stealing or something negative. Having the (almost) same API surface as another MIT library is hardly a "ripoff" but a re-implementation. Edit: since new evidence has come forward (https://news.ycombinator.com/item?id=27275379 https://news.ycombinator.com/item?id=27275379) I think we can all agree that Lodash is a fork of Underscore.js, nothing more and nothing else.
- goldenkey 5y ago
  Allowed or legal doesn't imply couth. As far as I can tell, Lodash no longer mentions Underscore anywhere. This seems wrong..as if one wants to look more original than one actually is. I have no qualms with forks or reimplementations (ie. Android - Java.) I actively support the paradigm. But in this case, it's pretty shitty to try to erase all evidence of said inspiration. Most forks and reimplementations don't do that. They pay homage to their origin with at least a shout out.
  - capableweb 5y ago
    I don't think Lodash ever "credited" Underscore.js for it's origin. Lodash used to have a "compat" version that promised to work the same as Underscore.js but with better performance, but I think that's about it. After some digging, it seems like the Lodash website stopped mentioning Underscore.js around 2015 sometime, but even before that, it never had "evidence of said inspiration" as claimed by you. Here are the versions I looked at: - https://web.archive.org/web/20120826202523/http://lodash.com/ https://web.archive.org/web/20120826202523/http://lodash.com... - https://web.archive.org/web/20130502014523/http://lodash.com/ https://web.archive.org/web/20130502014523/http://lodash.com... - https://web.archive.org/web/20140517192947/http://lodash.com/ https://web.archive.org/web/20140517192947/http://lodash.com... - https://web.archive.org/web/20150513014815/https://lodash.com/ https://web.archive.org/web/20150513014815/https://lodash.co... - https://web.archive.org/web/20160803063412/https://lodash.com/ https://web.archive.org/web/20160803063412/https://lodash.co... - https://web.archive.org/web/20170830163720/https://lodash.com/ https://web.archive.org/web/20170830163720/https://lodash.co... - https://web.archive.org/web/20180703043557/https://lodash.com/ https://web.archive.org/web/20180703043557/https://lodash.co... - https://web.archive.org/web/20190803030353/https://lodash.com/ https://web.archive.org/web/20190803030353/https://lodash.co... - https://web.archive.org/web/20200615092636/http://lodash.com/ https://web.archive.org/web/20200615092636/http://lodash.com... - https://web.archive.org/web/20210314233141/https://lodash.com/ https://web.archive.org/web/20210314233141/https://lodash.co...
hinkley 5y ago
How is underscore these days? Lodash as an npm module is out of control, file-size wise, and I'm not sure I'm really getting anything for it, other than once a year having to make sure we don't have ten copies of it that can't be deduped (Currently it's occupying 29MB of disk space on my production machines)

achempion 5y ago

You could try to look on in from another perspective. The library is free and worked on by maintainers in a spare time from main duties (not talking here about lodash specifically). Maintainers don't own you any support nor obliged to work the way you may think they should. I would say that it's great that we have many tools and should give more respect to maintainers which basically save you a ton of resources and maximum they ask for is to follow the established processes.

deleted 5y ago
[deleted]
NetOpWibby 5y ago
You haven’t addressed the hostile attitude of the maintainer, which was the point.
- a1369209993 5y ago
  The hostile and deceptive attitude of the maintainer. If they honestly admitted that they didn't give a crap about bug reports, or even just didn't bother setting up any system for recieving them, that would disappointing, but achempion's comment would cover the situation nicely. The problem (assuming the previously stated facts are accurate) is they actively set up a system to solicit and recieve bug reports, and then systematically sabotaged and neglected that system when people tried to actually report bugs.
- hinkley 5y ago
  I feel like we could have the same conversation about the Docker folks and so this feels more like a popularity contest than an objective conversation.
  - CRConrad 5y ago
    It's not as if "Person or group B are also objectively arseholes!" logically invalidates "Person or group A are objectively arseholes", is it?

Qub3d 5y ago

Also known as the "Cascade of Attention Deficit Teenagers" (CADT) development model: https://archive.is/l4svG https://archive.is/l4svG (jwz link, so archive.is)

Rompect 5y ago

I never understood how people used lodash. Basically every function can be copied and just inserted into ones own codebase and you have one less dependency, which is very pleasant. And they are all so simple that there will never be a problem.

meetups323 5y ago
> And they are all so simple that there will never be a problem. "Simple JS can't have unexpected security/performance pitfalls". Hah. https://www.cvedetails.com/vulnerability-list.php?vendor_id=20100&product_id=57083&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=4&sha=ec99d3827329b3d01f3412ca337b0d88dfbde6dc https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- no_wizard 5y ago
  Disclaimer: I am not a security expert! This is my layman's attempt at mentioning a common vulnerability too many programs have but not enough knowledge is spread about it. It's easy enough to mitigate in most apps but I don't think most do. I know this isn't directly related, however one of the vulnerabilities is prototype pollution [0], a deceptively simple technique that I think so many apps are vulnerable to. It goes like the following: - Get an application to serialize or take `__proto__`, `constructor` or `prototype` as an input so it's a key on a JS Object - Serialize its value to something nasty, like `'{"auth": {"name": "user", "password": "pwd"}, "message": { "text": "", "__proto__": {"canDelete": true}}}'` [1] This high jacks the prototype of the object and adding those specified properties. If you do things like deep merging of objects on data, you are susceptible to this without the proper guards in hydration / rehydration. The mitigation is simple: don't allow objects to have `constructor`, `prototype`, or `__proto__`. You can delete them by customizing JSON.parse (by passing a reviver [2]) or using something like `mergeWith` to skip these keys A similar vulnerability exists with `constructor` and `prototype` as well [3] [0]: https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications https://portswigger.net/daily-swig/prototype-pollution-the-d... [1]: https://github.com/Kirill89/prototype-pollution-explained https://github.com/Kirill89/prototype-pollution-explained [2]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/parse#syntax https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... [3]: https://shieldfy.io/security-wiki/prototype-pollution/introduction-to-prototype-pollution/ https://shieldfy.io/security-wiki/prototype-pollution/introd...