7 ms·

One programmer broke the internet by deleting left-pad (2016)

33 points by Anon84 5y ago

croes 5y ago
Article is from 2016 about the npm left-pad problem
deleted 5y ago
[deleted]
United857 5y ago
If you have to depend on a external library for a simple function which can be written in a intro programming course, it's a red flag.
- tinco 5y ago
  If you have to depend on Node.JS to run your service, it's a red flag. Still I'm seriously considering Node.JS for every backend project we start, just because it's so much easier to hire for, and the ecosystem is so healthy. We're living in a red flag time for software development.
  - xupybd 5y ago
    Isn't Go starting to gain popularity without the downside of Node? I'm saying this as someone that hasn't used either.
  - quonn 5y ago
    There‘s nothing wrong with NodeJS in principle, especially when combined with TypeScript. Can you point to something specific?
    - georgyo 5y ago
      For me personally, the fact that even a simple node project will have well over 1000 dependencies is a problem. Slightly more complex projects will have more than 10k dependencies. Auditing is nearly impossible. The complete lack of a standard stdlib means always relying on community packages. Also, not a complaint directly against node directly, but for the ecosystem and developers. There is not a culture of compatibility, further fueled by the fact that multiple versions of the same dependency can be included in the same code base by different dependencies. Coming from any other language were it is a goal to keep external dependencies down, nodejs is nightmare fuel.
    - michaelt 5y ago
      Many people judge programming languages as not just the language, but also the tools, library, community, conventions and so on. After all, if I love Java but hate AbstractSingletonProxyFactoryBeans, I'm probably going to hate being a professional Java developer. Some would see the left-pad incident not as an isolated oddity, but as representative of the entire NodeJS ecosystem - showing a weak standard library, a culture of pulling random, unaudited code from the internet, and rats-nest dependencies.
- onion2k 5y ago
  It's much worse than that. String.prototype.padStart has been available in Node since 8.0, and browsers for a long time. It's not in IE but polyfills are common. If your first thought is a library, whether you wrote it yourself or not, then you're doing JS badly.
  - Vinnl 5y ago
    To be fair, Node.js 8 was released in 2017; this happened in 2016.
- Cthulhu_ 5y ago
  One big problem here is that Node (and Javascript)'s standard libraries do / did not have a lot of these utilities yet. It's the same with e.g. Java, so Apache Commons is one of the most common libraries to find in a Java application. Go seems to have done a better job with a lot of utilities found in its standard library. But, it also has a mindset that it's better to just copy code than to add a dependency. Another factor there was of course that dependency management was a bit painful and fragmented until a few releases ago, unlike NodeJS which had NPM and its ecosystem not long after it came out.
- rShergold 5y ago
  It seems to be really common to sling mud at the JavaScript/NPM ecosystem from developers who work in other domains. One of the big constraints we have in front end development is that every added feature adds to the bundle size of code we have to send down the wire to the end user. When I worked in mobile app development third party libraries tended to be very large with many many features. Only a tiny fraction of that library ends up matching your use case. However when you build you end up bundling up the whole thing into your app. JavaScript has more of a culture of many many small hyper focused packages. The logical conclusion being single function packages like left pad. This has two benefits. One - you have less dead code in your final build. Two - if one of your dependencies is already using leftpad you essentially get to use it "for free". If everyone did what you are suggesting you would find multiple instances of leftpad. One version you wrote. One version your dependency wrote. One version your dependency's dependency wrote etc.
  - ginko 5y ago
    >When I worked in mobile app development third party libraries tended to be very large with many many features. Only a tiny fraction of that library ends up matching your use case. However when you build you end up bundling up the whole thing into your app. Surely there have to be tools to process dependency libraries to strip out any unused code.
    - rShergold 5y ago
      yeah it's called Tree Shaking. It's been a massive area of improvement over the last few years. However JavaScript being dynamic can be very difficult to effectively statically analyse. A good example: There is a library called Moment for handling dates. Due to the way the interface was built it basically can't be tree shaken. It's an excellent library but it's on the heavy side. For a while now people have been moving to libraries like Date-Fns which are collections of individual functions. This library can be tree shaken as it's obvious which functions you are using and which you are not
  - austincheney 5y ago
    As a front end developer with nearly 20 years of experience I can objectively call bullshit. The problem is Invented Here syndrome and coddling. https://en.m.wikipedia.org/wiki/Invented_here https://en.m.wikipedia.org/wiki/Invented_here The reason this exists is due to a lack of leadership in the front end space. More specifically, a need to hire untrained entry level developers and deliberately not train them whether due to insecurity elsewhere and a complete inability to write documentation. > If everyone did what you are suggesting you would find multiple instances of leftpad. It was about 8 lines of code a child could write that you probably don’t need in the first place.
DocTomoe 5y ago
The headline makes it look like a mistake, like a developer lacking care, when this was the result of a deliberate - and I would argue: legitimate - action that spiralled out of control because of too many people trusting SPoFs. Also, breaking some javascript code on the web is hardly "breaking the internet".
- Ekaros 5y ago
  When I heard "breaking the internet" I think there was some massive BGP issue or root-DNS mess up... Not that some websites could not release new pages anymore...
jimnotgym 5y ago
I side with Kik messenger and npm immediately. I don't agree with lots of IP law, but Trademarks are different. Trademarks are an important consumer protection.
- DocTomoe 5y ago
  I agree in principle, but do think there should be a minimum length for a trademark, to avoid destroying useful (x)TLA acronym space. "American Airlines" is rightfully trademarkeable, but "AA" should not be (and in fact can be understood to mean all kind of things, even in aviation) "Lego" is a trademark for plastic bricks, but the London Electric Guitar Orchestra should be able to use "L.E.G.O" or even "LEGO" as an acronym - they make music, not construction toys. Unfortunately, there is no indication in the article what kik (as in the developers package) stood for, but if the package had nothing to do with Kik, the service, I think it should not be a trademark violation.
  - jimnotgym 5y ago
    I think the point about AA is that it was in general use in language before there were Airlines. Kik is different. I have never used Kik, but I was aware of it in 2016. When I read the article I immediately thought of the messenger. It also does not have any other common English use to my knowledge. Trademarks are only valid in the domain you operate in. If you had a football school called kik there is no infringement, but there is an Internet company called kik hence this infringes.
    - DocTomoe 5y ago
      According to [1], Koçulu's kik "a new module that would kick-start the set up of new projects, and he named this module “kik.”" Also, Stratton seemed to try and prevent the use of a "kik-starter" as well. That doesn't sound too much like the package to deal with social media to me. Arguing that they are in the same domain because of both of them being internet-related seems like American Airlines trying to sue Alcoholics Anonymous for an AA trademark violation, for both pilots and recovering alcoholics sometimes use roads. [1] https://kikloginonline.com/kik-npm-package-name/ https://kikloginonline.com/kik-npm-package-name/
RalfWausE 5y ago
"Un-un-publishing"... THIS is one reason i highly distrust any online service that is not under my full control (e.g.: I can only fully trust a server in my basement). If i want some services, code or programs i have created gone i want the power to MAKE them gone for good.
- MichaelBurge 5y ago
  Unfortunately websites like archive.org mean that if you post any code anywhere online at any time, you forever lose the ability to stop your code from replicating, even if it was originally posted on a server you control.
- Nyra 5y ago
  You are right. Part of the magic that drives FOSS is that everyone is willingly contributing. If a developer no longer wants to do that, they should be able to make that decision, not npm. That’s without mentioning that the fallout was a direct result of their poor decision-making up that point anyway. npm should have just laughed at kik for coming to them about an unrelated, unmalicious package like this.
  - ivanhoe 5y ago
    If you don't want to contribute anymore you don't have to, just go and do something else - but once the code was published it's not just "yours" anymore, it belongs to the community, that's the whole idea behind OSS. You give it away to everyone and anyone to use it and fork it and un-unpublish it as much as they like...
    - RalfWausE 5y ago
      This is (in my opinion) the problem with (most? all?) OSS licence models: What if your software or parts of your software are used against your will or intention? What if your software or parts thereof is taken by the "Big Tech", commercialized and you think this is a total perversion of the intention you had while writing this software? The more i think about the possibilities the less i like the idea...
sonovice 5y ago
Relevant xkcd: https://xkcd.com/2347/ https://xkcd.com/2347/
edem 5y ago
Note that this wasn't careless programming. The developer who was publishing the module pulled the release because he was threatened by a company named Kik who wanted to take over his namespace. After pulling it Joyent had no choice but to restore the module to prevent the whole ecosystem from collapsing. I think the core problem here is that releases should be immutable, just like with Java (Maven Central). Once you put something out there it should stay there until nuclear fire destroys the world, otherwise you risk bringing down the whole ecosystem, just like how it happened with `left_pad`.
- tgv 5y ago
  Or people copy dependencies to their own repos and build from there. You can't rely on a company, even one like github/MS, to exist until end of times.
- ezoe 5y ago
  What if it contains copyright infringement, Government classified information, Child pornography, personal data, and all the data the law prohibit to distribute? Our society cannot stand the immutability yet. Our build process shouldn't relies on somebody else's server over the Internet for each minor deploys to the web server.
  - amingilani 5y ago
    > Our society cannot stand the immutability yet. I hate to point it out, but we already have immutability. If you add something to, say, the Bitcoin blockchain, it'd take erasing the entire blockchain to destroy that information. That's a tall order.
    - georgyo 5y ago
      Since Bitcoin allows for storing small amounts arbitrary data in a transaction. Seems like an attack vector is to put illegal content into the Blockchain.
      - 5y ago
deleted 5y ago
[deleted]
superasn 5y ago
What if 'left-pad' was the trademark name in question instead ok kik. Would npm un-unpublish that or let the internet remain broken forever?
daitangio 5y ago
I remember this issue. It was funny and scared a bit how node dependency works. Some said, node ecosystem was a bit too exagerated to relay on very tiny library like that. On other side having on a good number of dependencies on your package.json is a good sign, because you have a strong structured ecosystem to relay onto. Keep in mind a singular angular app has about 1Gb of node_modules dependencies whereas a java spring boot app is hardly so big :)
- turminal 5y ago
  > On other side having on a good number of dependencies on your package.json is a good sign, because you have a strong structured ecosystem to relay onto. What's "strong structured ecosystem" supposed yo mean?
  - aenario 5y ago
    That when you need a given feature, you will more probably find an actively maintained package which cover it and is compatible with the rest of your dependencies/framework.
maxloh 5y ago
That is a problem that may happen on Deno or Go one day. If one of your dependency is deleted from GitHub, your project breaks, and you may never find your missing dependency again.
ginko 5y ago
Serious question from someone not in the web development field: What's keeping developers from just downloading the js libraries they depend on and hosting them themselves?
- dagw 5y ago
  Technically nothing. Practically, it's not the default behavior and none of the Getting Started documentation you'll read will teach you how to do it. So almost nobody does.
- huseyinkeles 5y ago
  Nothing keeps you, but it's not easy to keep them up to date manually + those libraries have their own dependencies.
- Cthulhu_ 5y ago
  It's not uncommon for companies to host a proxy that theoretically can guard against depublishing; probably a good practice as well since it offloads the npm repo. But, someone has to set that up and take ownership of it, which is a problem in most companies (it's often some guy that sets it up and it runs fine for years afterwards, until it doesn't)
- globular-toast 5y ago
  Nothing. There are even off the shelf solutions available (like Artifactory). But it's not part of standard tooling and many web developers don't really know what they're doing when it comes to this stuff. I do a lot of interviewing and I'm amazed by how many developers not only don't seem to care much about dependencies but don't even understand that it's a problem at all. In another industry this would be used an example failure for training new engineers. But people seem to have an aversion to formal training and prefer on-the-job training. But that means you can easily end up with an engineer who simply "got lucky" for 5 years by not following any kind of good practice. Do you really want him to learn these lessons with your data/time/money?

33 points by Anon84 5y ago

croes 5y ago

Article is from 2016 about the npm left-pad problem

deleted 5y ago

[deleted]

United857 5y ago

If you have to depend on a external library for a simple function which can be written in a intro programming course, it's a red flag.

tinco 5y ago
If you have to depend on Node.JS to run your service, it's a red flag. Still I'm seriously considering Node.JS for every backend project we start, just because it's so much easier to hire for, and the ecosystem is so healthy. We're living in a red flag time for software development.
- xupybd 5y ago
  Isn't Go starting to gain popularity without the downside of Node? I'm saying this as someone that hasn't used either.
- quonn 5y ago
  There‘s nothing wrong with NodeJS in principle, especially when combined with TypeScript. Can you point to something specific?
  - georgyo 5y ago
    For me personally, the fact that even a simple node project will have well over 1000 dependencies is a problem. Slightly more complex projects will have more than 10k dependencies. Auditing is nearly impossible. The complete lack of a standard stdlib means always relying on community packages. Also, not a complaint directly against node directly, but for the ecosystem and developers. There is not a culture of compatibility, further fueled by the fact that multiple versions of the same dependency can be included in the same code base by different dependencies. Coming from any other language were it is a goal to keep external dependencies down, nodejs is nightmare fuel.
  - michaelt 5y ago
    Many people judge programming languages as not just the language, but also the tools, library, community, conventions and so on. After all, if I love Java but hate AbstractSingletonProxyFactoryBeans, I'm probably going to hate being a professional Java developer. Some would see the left-pad incident not as an isolated oddity, but as representative of the entire NodeJS ecosystem - showing a weak standard library, a culture of pulling random, unaudited code from the internet, and rats-nest dependencies.
onion2k 5y ago
It's much worse than that. String.prototype.padStart has been available in Node since 8.0, and browsers for a long time. It's not in IE but polyfills are common. If your first thought is a library, whether you wrote it yourself or not, then you're doing JS badly.
- Vinnl 5y ago
  To be fair, Node.js 8 was released in 2017; this happened in 2016.
Cthulhu_ 5y ago
One big problem here is that Node (and Javascript)'s standard libraries do / did not have a lot of these utilities yet. It's the same with e.g. Java, so Apache Commons is one of the most common libraries to find in a Java application. Go seems to have done a better job with a lot of utilities found in its standard library. But, it also has a mindset that it's better to just copy code than to add a dependency. Another factor there was of course that dependency management was a bit painful and fragmented until a few releases ago, unlike NodeJS which had NPM and its ecosystem not long after it came out.
rShergold 5y ago
It seems to be really common to sling mud at the JavaScript/NPM ecosystem from developers who work in other domains. One of the big constraints we have in front end development is that every added feature adds to the bundle size of code we have to send down the wire to the end user. When I worked in mobile app development third party libraries tended to be very large with many many features. Only a tiny fraction of that library ends up matching your use case. However when you build you end up bundling up the whole thing into your app. JavaScript has more of a culture of many many small hyper focused packages. The logical conclusion being single function packages like left pad. This has two benefits. One - you have less dead code in your final build. Two - if one of your dependencies is already using leftpad you essentially get to use it "for free". If everyone did what you are suggesting you would find multiple instances of leftpad. One version you wrote. One version your dependency wrote. One version your dependency's dependency wrote etc.
- ginko 5y ago
  >When I worked in mobile app development third party libraries tended to be very large with many many features. Only a tiny fraction of that library ends up matching your use case. However when you build you end up bundling up the whole thing into your app. Surely there have to be tools to process dependency libraries to strip out any unused code.
  - rShergold 5y ago
    yeah it's called Tree Shaking. It's been a massive area of improvement over the last few years. However JavaScript being dynamic can be very difficult to effectively statically analyse. A good example: There is a library called Moment for handling dates. Due to the way the interface was built it basically can't be tree shaken. It's an excellent library but it's on the heavy side. For a while now people have been moving to libraries like Date-Fns which are collections of individual functions. This library can be tree shaken as it's obvious which functions you are using and which you are not
- austincheney 5y ago
  As a front end developer with nearly 20 years of experience I can objectively call bullshit. The problem is Invented Here syndrome and coddling. https://en.m.wikipedia.org/wiki/Invented_here https://en.m.wikipedia.org/wiki/Invented_here The reason this exists is due to a lack of leadership in the front end space. More specifically, a need to hire untrained entry level developers and deliberately not train them whether due to insecurity elsewhere and a complete inability to write documentation. > If everyone did what you are suggesting you would find multiple instances of leftpad. It was about 8 lines of code a child could write that you probably don’t need in the first place.

DocTomoe 5y ago

The headline makes it look like a mistake, like a developer lacking care, when this was the result of a deliberate - and I would argue: legitimate - action that spiralled out of control because of too many people trusting SPoFs. Also, breaking some javascript code on the web is hardly "breaking the internet".

Ekaros 5y ago
When I heard "breaking the internet" I think there was some massive BGP issue or root-DNS mess up... Not that some websites could not release new pages anymore...

jimnotgym 5y ago

I side with Kik messenger and npm immediately. I don't agree with lots of IP law, but Trademarks are different. Trademarks are an important consumer protection.

DocTomoe 5y ago
I agree in principle, but do think there should be a minimum length for a trademark, to avoid destroying useful (x)TLA acronym space. "American Airlines" is rightfully trademarkeable, but "AA" should not be (and in fact can be understood to mean all kind of things, even in aviation) "Lego" is a trademark for plastic bricks, but the London Electric Guitar Orchestra should be able to use "L.E.G.O" or even "LEGO" as an acronym - they make music, not construction toys. Unfortunately, there is no indication in the article what kik (as in the developers package) stood for, but if the package had nothing to do with Kik, the service, I think it should not be a trademark violation.
- jimnotgym 5y ago
  I think the point about AA is that it was in general use in language before there were Airlines. Kik is different. I have never used Kik, but I was aware of it in 2016. When I read the article I immediately thought of the messenger. It also does not have any other common English use to my knowledge. Trademarks are only valid in the domain you operate in. If you had a football school called kik there is no infringement, but there is an Internet company called kik hence this infringes.
  - DocTomoe 5y ago
    According to [1], Koçulu's kik "a new module that would kick-start the set up of new projects, and he named this module “kik.”" Also, Stratton seemed to try and prevent the use of a "kik-starter" as well. That doesn't sound too much like the package to deal with social media to me. Arguing that they are in the same domain because of both of them being internet-related seems like American Airlines trying to sue Alcoholics Anonymous for an AA trademark violation, for both pilots and recovering alcoholics sometimes use roads. [1] https://kikloginonline.com/kik-npm-package-name/ https://kikloginonline.com/kik-npm-package-name/

RalfWausE 5y ago

"Un-un-publishing"... THIS is one reason i highly distrust any online service that is not under my full control (e.g.: I can only fully trust a server in my basement). If i want some services, code or programs i have created gone i want the power to MAKE them gone for good.

MichaelBurge 5y ago
Unfortunately websites like archive.org mean that if you post any code anywhere online at any time, you forever lose the ability to stop your code from replicating, even if it was originally posted on a server you control.
Nyra 5y ago
You are right. Part of the magic that drives FOSS is that everyone is willingly contributing. If a developer no longer wants to do that, they should be able to make that decision, not npm. That’s without mentioning that the fallout was a direct result of their poor decision-making up that point anyway. npm should have just laughed at kik for coming to them about an unrelated, unmalicious package like this.
- ivanhoe 5y ago
  If you don't want to contribute anymore you don't have to, just go and do something else - but once the code was published it's not just "yours" anymore, it belongs to the community, that's the whole idea behind OSS. You give it away to everyone and anyone to use it and fork it and un-unpublish it as much as they like...
  - RalfWausE 5y ago
    This is (in my opinion) the problem with (most? all?) OSS licence models: What if your software or parts of your software are used against your will or intention? What if your software or parts thereof is taken by the "Big Tech", commercialized and you think this is a total perversion of the intention you had while writing this software? The more i think about the possibilities the less i like the idea...

sonovice 5y ago

Relevant xkcd: https://xkcd.com/2347/ https://xkcd.com/2347/

edem 5y ago

Note that this wasn't careless programming. The developer who was publishing the module pulled the release because he was threatened by a company named Kik who wanted to take over his namespace. After pulling it Joyent had no choice but to restore the module to prevent the whole ecosystem from collapsing. I think the core problem here is that releases should be immutable, just like with Java (Maven Central). Once you put something out there it should stay there until nuclear fire destroys the world, otherwise you risk bringing down the whole ecosystem, just like how it happened with `left_pad`.

tgv 5y ago
Or people copy dependencies to their own repos and build from there. You can't rely on a company, even one like github/MS, to exist until end of times.
ezoe 5y ago
What if it contains copyright infringement, Government classified information, Child pornography, personal data, and all the data the law prohibit to distribute? Our society cannot stand the immutability yet. Our build process shouldn't relies on somebody else's server over the Internet for each minor deploys to the web server.
- amingilani 5y ago
  > Our society cannot stand the immutability yet. I hate to point it out, but we already have immutability. If you add something to, say, the Bitcoin blockchain, it'd take erasing the entire blockchain to destroy that information. That's a tall order.
  - georgyo 5y ago
    Since Bitcoin allows for storing small amounts arbitrary data in a transaction. Seems like an attack vector is to put illegal content into the Blockchain.
    - 5y ago

deleted 5y ago

[deleted]

superasn 5y ago

What if 'left-pad' was the trademark name in question instead ok kik. Would npm un-unpublish that or let the internet remain broken forever?

daitangio 5y ago

I remember this issue. It was funny and scared a bit how node dependency works. Some said, node ecosystem was a bit too exagerated to relay on very tiny library like that. On other side having on a good number of dependencies on your package.json is a good sign, because you have a strong structured ecosystem to relay onto. Keep in mind a singular angular app has about 1Gb of node_modules dependencies whereas a java spring boot app is hardly so big :)

turminal 5y ago
> On other side having on a good number of dependencies on your package.json is a good sign, because you have a strong structured ecosystem to relay onto. What's "strong structured ecosystem" supposed yo mean?
- aenario 5y ago
  That when you need a given feature, you will more probably find an actively maintained package which cover it and is compatible with the rest of your dependencies/framework.

maxloh 5y ago

That is a problem that may happen on Deno or Go one day. If one of your dependency is deleted from GitHub, your project breaks, and you may never find your missing dependency again.

ginko 5y ago

Serious question from someone not in the web development field: What's keeping developers from just downloading the js libraries they depend on and hosting them themselves?

dagw 5y ago
Technically nothing. Practically, it's not the default behavior and none of the Getting Started documentation you'll read will teach you how to do it. So almost nobody does.
huseyinkeles 5y ago
Nothing keeps you, but it's not easy to keep them up to date manually + those libraries have their own dependencies.
Cthulhu_ 5y ago
It's not uncommon for companies to host a proxy that theoretically can guard against depublishing; probably a good practice as well since it offloads the npm repo. But, someone has to set that up and take ownership of it, which is a problem in most companies (it's often some guy that sets it up and it runs fine for years afterwards, until it doesn't)
globular-toast 5y ago
Nothing. There are even off the shelf solutions available (like Artifactory). But it's not part of standard tooling and many web developers don't really know what they're doing when it comes to this stuff. I do a lot of interviewing and I'm amazed by how many developers not only don't seem to care much about dependencies but don't even understand that it's a problem at all. In another industry this would be used an example failure for training new engineers. But people seem to have an aversion to formal training and prefer on-the-job training. But that means you can easily end up with an engineer who simply "got lucky" for 5 years by not following any kind of good practice. Do you really want him to learn these lessons with your data/time/money?