9 ms·

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break t

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js. This isn't an ecosystem that you want to build and maintain a product on.

extheat 5y ago
So you’re basically saying, don’t use X tool chain because the 3rd party software doesn’t move on your pace? Or they have different “views” than yours? I don’t see how that makes any sense. Why do you have to be beholden 3rd party developers and the pace they work at?
- slackfan 5y ago
  I use software to build stuff, not to subscribe to a set of political ideologies.
  - trentnix 5y ago
    A small, extremely loud, and extremely sanctimonious part of the population will not accept that. They will consider your lack of political motivation for your work distasteful and eventually immoral. You'll be asked to support movements, participate in ritual, and publicly proclaim your allegiance. Eventually, they'll demand it. “Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive. It would be better to live under robber barons than under omnipotent moral busybodies. The robber baron's cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for our own good will torment us without end for they do so with the approval of their own conscience. They may be more likely to go to Heaven yet at the same time likelier to make a Hell of earth. This very kindness stings with intolerable insult. To be "cured" against one's will and cured of states which we may not regard as disease is to be put on a level of those who have not yet reached the age of reason or those who never will; to be classed with infants, imbeciles, and domestic animals.” - C.S. Lewis
    - slackfan 5y ago
      Oh there's no eventually. They've been demanding it for years. There's a very good reason why some software on my machines is already pinned to specific versions, and will not under any circumstances be upgraded. Thankfully the field of software development has stagnated to the point that there really hasn't been any significant improvements to actual non-web software in about 15 years, so I'm looking forward to the brand new world with a stack of ancient machines, a bunch of boxes of capacitors, and a few hard drives' worth of abandonware, because frankly, fuck that noise THE AMISH WERE RIGHT.
    - beaconstudios 5y ago
      not every politics-adjacent thread needs to devolve into "the wokes are coming for us all". You can disagree with the actions of progressives without making it this all-encompassing threat. Hell, I'm pretty left-wing and I'm fairly critical of some of the factions. Either way, I can't see anybody putting "must add a BLM banner to their website" to the licensing conditions of their FOSS code.
      - slackfan 5y ago
        That would be a wonderful thing to able be do, if the woke brigade wasn't screaming "YOU'RE WITH US OR YOU'RE AGAINST US" a parent over. ;) Ignoring that isn't an option, unfortunately, believe me, that's been tried.
        beaconstudios 5y ago
        Yeah but so what? Disagreements are going to happen in politics. Other people disliking your politics and vice-versa is not an existential threat. Anybody who legitimately makes a "liberals only" stand in their license will get forked and their usage will drop off.
        slackfan 5y ago
        >yeah but so what Being silent about shitty behavior is the same as condoning it, don't you know? Just because you don't like the playbook doesn't mean it doesn't work. >Anybody who legitimately makes a "liberals only" stand in their license will get forked and their usage will drop off. Considering that the developer just pulled a "no russians" stand with their software...
- trentnix 5y ago
  I'm not sure if you being purposely obtuse, but the idea that you'd build your software on top of a technology or platform that might introduce instability due to the whims or politics of its stewards is absolutely and obviously a risk worth considering.
- bmj 5y ago
  Did you read the parent article? But, in at least one case—the peacenotwar module in the node-ipc package—an update sabotages npm developers with code intended to wipe data stored in Russia and Belarus. In a March 16 blog post on the malicious code, Liran Tal at Snyk said, “This security incident involves destructive acts of corrupting files on disk by one maintainer and their attempts to hide and restate that deliberate sabotage in different forms.” This has nothing to do with pace of development, or even the political views of the developers. It has to do with inserting what is essentially malware into open source packages that affect users based on geo-location.
  - extheat 5y ago
    OK, and how is this something unique to the Node.js package ecosystem? What's stopping someone on PyPI/some other PM from doing the same thing? I personally view these more as malicious copycat acts than anything inherent with the ecosystem. Should NPM start manually reviewing all of the packages that go through them, because the handful of abusers? I'm not so sure. The situation on languages without a widely used package manager/ecosystem like C++ I don't think is any better.
- marcosdumay 5y ago
  Well, do you think doing what you said is a bad policy? It looks pretty sane and effective to me. > Why do you have to be beholden 3rd party developers and the pace they work at? You don't "have to", you only are beholden to them if you use their software.
dewey 5y ago
Isn't this mostly a problem of auto-updating and non-pinned dependencies? If you vendor and audit your dependencies this isn't really a problem.
- mushyhammer 5y ago
  Yes true but have you audited your thousands of modules? If you have a build tool that wasn’t born in 2020 chances are it pulls a hundred dependencies from 20 separate vendors. I saw this as a JS developer who scarily runs npm installs multiple times a day.
staticelf 5y ago
Basically all big js front ends have the same issue. Most of them had banners or whole pages for the BLM movement which made no sense to anyone outside of the US like myself. I mean a framework or library with a global audience shouldn't push american politics. Vue, React, Preact, Nodejs, Ember (had a whole page and made documentation unavailable for some time), Go lang, ExpressJS (still has the banner up), Typescript, a lot of python projects etc etc. The list can be made very long. I try to avoid any framework and library that pushes political agendas onto their sites because that signals what type of people are in charge of them. They must think that their political views are so important it must infiltrate every aspect of life even if the thing has nothing to do with it. Unfortunately, there is such a large amount of them doing this it's practically impossible to avoid it. The funny thing is, now when Russia has invaded Ukraine there is no banners on the same websites so it's obvious some lives matters more than others in their views..
- lucasmullens 5y ago
  > The funny thing is, now when Russia has invaded Ukraine there is no banners on the same websites so it's obvious some lives matters more than others in their views.. Supporting one issue publicly does not mean you think it's more important than every issue you don't support publicly.
  - staticelf 5y ago
    > Supporting one issue publicly does not mean you think it's more important than every issue you don't support publicly. There is a big difference with war and people being systematically killed and a potential unjust legal system. War is obviously many times worse in every aspect and I think it's hilarious on what these people publicly support and what they don't. It's hypocritical, unfair which makes it a big irony since that was what the BLM movement was all about (unfair treatment).
  - vorpalhex 5y ago
    It would seem to. That was literally the whole thing of "inclusive language" right? It wasn't about what the words actually mean, just how people felt about them. If they felt the word was discriminatory, then it should be fixed. If you're going to throw up banners on every JS site for one cause and not another, you're saying very loudly you don't care as much about the other. You, under the logic of "discriminatory language" even be engaging in discrimination.
EnKopVand 5y ago
It’s a problem in any ecosystem. It’s not like there haven’t been attacks in nuget packages or the recently famous Log4j vulnerability. I’m not going to pretend there aren’t some pretty deep flaws with nested dependencies in Node modules, but it’s really more an issue with unprofessionalism in my eyes. I’ve never worked a place that would auto-magically roll out things like windows or chrome updates without having them vetted first. If you can’t trust those, then you certainly can’t trust some random NPM package, and if your organisation doesn’t have a strategy for how you handle something that unsafe then you really need to step up your professionalism. I personally consider NPM packages to be sort or nice, in the very cynical way, that the community tends to beta test updates for you much faster than with any other dependency system.
- nonameiguess 5y ago
  Not all ecosystems are the same in the extent to which auditing and maintaining dependency chains is a burden. All of Linux from Scratch consists of something like less than 90 distinct dependencies, for instance. When I went to add a token-replacement library to mdbook so I can interpolate variables in a book, Cargo pulled in 287 dependencies. For better or worse, the newer, hotter languages of the day seem to be predicated on extremely small, something single-function, libraries, and thus enormous and arguably intractable dependency trees.
ComradePhil 5y ago
That reminded me of the whole Ayo.js thing: https://github.com/ayojs/ayo https://github.com/ayojs/ayo The NodeJS community somehow tends to attract the worst kind of people.
devmunchies 5y ago
I’ll be using Deno for new projects from now on.
pelasaco 5y ago
again, nothing blocks you to have a better supply chain to your software: Download all dependencies and freeze them, fork the dependencies and groom your fork or have dependantbot or depfu managing your dependencies for you and keep a delay between merging the PRs, have manual review, etc.. You shouldn't be pulling stuff from internet and pushing to production without take a look into that anyway...
shuntress 5y ago
All things are inherently "political" just not always significant enough to be worth considering. The trite ways to say it (ie: "we live in a society" or "actions have consequences") don't really capture the full complexity of human interaction but do somewhat describe the notion that everything you do as an individual affects and is affected by everything everyone else does. Being "political" really means just believing that those effects are too significant to ignore.
- raxxorrax 5y ago
  What makes everything political? Of course something I do or say can influence others, but it is still not political in the vast majority of instances. Not even non-significantly. Political action is shaping my environment to my desire. Via compromise or war perhaps. What is your definition of it that it applies to everything?
  - BlueTemplar 5y ago
    That's just action. What makes it political is if happens to have an effect outside of your home. (And technically even those restricted to the inside will usually end up having some sort of effect outside of your home.)
    - raxxorrax 5y ago
      Hm, I disagree that any effect has to be political. If so the word seems to have little intrinsic meaning.

extheat 5y ago

So you’re basically saying, don’t use X tool chain because the 3rd party software doesn’t move on your pace? Or they have different “views” than yours? I don’t see how that makes any sense. Why do you have to be beholden 3rd party developers and the pace they work at?

slackfan 5y ago
I use software to build stuff, not to subscribe to a set of political ideologies.
- trentnix 5y ago
  A small, extremely loud, and extremely sanctimonious part of the population will not accept that. They will consider your lack of political motivation for your work distasteful and eventually immoral. You'll be asked to support movements, participate in ritual, and publicly proclaim your allegiance. Eventually, they'll demand it. “Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive. It would be better to live under robber barons than under omnipotent moral busybodies. The robber baron's cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for our own good will torment us without end for they do so with the approval of their own conscience. They may be more likely to go to Heaven yet at the same time likelier to make a Hell of earth. This very kindness stings with intolerable insult. To be "cured" against one's will and cured of states which we may not regard as disease is to be put on a level of those who have not yet reached the age of reason or those who never will; to be classed with infants, imbeciles, and domestic animals.” - C.S. Lewis
  - slackfan 5y ago
    Oh there's no eventually. They've been demanding it for years. There's a very good reason why some software on my machines is already pinned to specific versions, and will not under any circumstances be upgraded. Thankfully the field of software development has stagnated to the point that there really hasn't been any significant improvements to actual non-web software in about 15 years, so I'm looking forward to the brand new world with a stack of ancient machines, a bunch of boxes of capacitors, and a few hard drives' worth of abandonware, because frankly, fuck that noise THE AMISH WERE RIGHT.
  - beaconstudios 5y ago
    not every politics-adjacent thread needs to devolve into "the wokes are coming for us all". You can disagree with the actions of progressives without making it this all-encompassing threat. Hell, I'm pretty left-wing and I'm fairly critical of some of the factions. Either way, I can't see anybody putting "must add a BLM banner to their website" to the licensing conditions of their FOSS code.
    - slackfan 5y ago
      That would be a wonderful thing to able be do, if the woke brigade wasn't screaming "YOU'RE WITH US OR YOU'RE AGAINST US" a parent over. ;) Ignoring that isn't an option, unfortunately, believe me, that's been tried.
      - beaconstudios 5y ago
        Yeah but so what? Disagreements are going to happen in politics. Other people disliking your politics and vice-versa is not an existential threat. Anybody who legitimately makes a "liberals only" stand in their license will get forked and their usage will drop off.
      - slackfan 5y ago
        >yeah but so what Being silent about shitty behavior is the same as condoning it, don't you know? Just because you don't like the playbook doesn't mean it doesn't work. >Anybody who legitimately makes a "liberals only" stand in their license will get forked and their usage will drop off. Considering that the developer just pulled a "no russians" stand with their software...
trentnix 5y ago
I'm not sure if you being purposely obtuse, but the idea that you'd build your software on top of a technology or platform that might introduce instability due to the whims or politics of its stewards is absolutely and obviously a risk worth considering.
bmj 5y ago
Did you read the parent article? But, in at least one case—the peacenotwar module in the node-ipc package—an update sabotages npm developers with code intended to wipe data stored in Russia and Belarus. In a March 16 blog post on the malicious code, Liran Tal at Snyk said, “This security incident involves destructive acts of corrupting files on disk by one maintainer and their attempts to hide and restate that deliberate sabotage in different forms.” This has nothing to do with pace of development, or even the political views of the developers. It has to do with inserting what is essentially malware into open source packages that affect users based on geo-location.
- extheat 5y ago
  OK, and how is this something unique to the Node.js package ecosystem? What's stopping someone on PyPI/some other PM from doing the same thing? I personally view these more as malicious copycat acts than anything inherent with the ecosystem. Should NPM start manually reviewing all of the packages that go through them, because the handful of abusers? I'm not so sure. The situation on languages without a widely used package manager/ecosystem like C++ I don't think is any better.
marcosdumay 5y ago
Well, do you think doing what you said is a bad policy? It looks pretty sane and effective to me. > Why do you have to be beholden 3rd party developers and the pace they work at? You don't "have to", you only are beholden to them if you use their software.

dewey 5y ago

Isn't this mostly a problem of auto-updating and non-pinned dependencies? If you vendor and audit your dependencies this isn't really a problem.

mushyhammer 5y ago
Yes true but have you audited your thousands of modules? If you have a build tool that wasn’t born in 2020 chances are it pulls a hundred dependencies from 20 separate vendors. I saw this as a JS developer who scarily runs npm installs multiple times a day.

staticelf 5y ago

Basically all big js front ends have the same issue. Most of them had banners or whole pages for the BLM movement which made no sense to anyone outside of the US like myself. I mean a framework or library with a global audience shouldn't push american politics. Vue, React, Preact, Nodejs, Ember (had a whole page and made documentation unavailable for some time), Go lang, ExpressJS (still has the banner up), Typescript, a lot of python projects etc etc. The list can be made very long. I try to avoid any framework and library that pushes political agendas onto their sites because that signals what type of people are in charge of them. They must think that their political views are so important it must infiltrate every aspect of life even if the thing has nothing to do with it. Unfortunately, there is such a large amount of them doing this it's practically impossible to avoid it. The funny thing is, now when Russia has invaded Ukraine there is no banners on the same websites so it's obvious some lives matters more than others in their views..

lucasmullens 5y ago
> The funny thing is, now when Russia has invaded Ukraine there is no banners on the same websites so it's obvious some lives matters more than others in their views.. Supporting one issue publicly does not mean you think it's more important than every issue you don't support publicly.
- staticelf 5y ago
  > Supporting one issue publicly does not mean you think it's more important than every issue you don't support publicly. There is a big difference with war and people being systematically killed and a potential unjust legal system. War is obviously many times worse in every aspect and I think it's hilarious on what these people publicly support and what they don't. It's hypocritical, unfair which makes it a big irony since that was what the BLM movement was all about (unfair treatment).
- vorpalhex 5y ago
  It would seem to. That was literally the whole thing of "inclusive language" right? It wasn't about what the words actually mean, just how people felt about them. If they felt the word was discriminatory, then it should be fixed. If you're going to throw up banners on every JS site for one cause and not another, you're saying very loudly you don't care as much about the other. You, under the logic of "discriminatory language" even be engaging in discrimination.

EnKopVand 5y ago

It’s a problem in any ecosystem. It’s not like there haven’t been attacks in nuget packages or the recently famous Log4j vulnerability. I’m not going to pretend there aren’t some pretty deep flaws with nested dependencies in Node modules, but it’s really more an issue with unprofessionalism in my eyes. I’ve never worked a place that would auto-magically roll out things like windows or chrome updates without having them vetted first. If you can’t trust those, then you certainly can’t trust some random NPM package, and if your organisation doesn’t have a strategy for how you handle something that unsafe then you really need to step up your professionalism. I personally consider NPM packages to be sort or nice, in the very cynical way, that the community tends to beta test updates for you much faster than with any other dependency system.

nonameiguess 5y ago
Not all ecosystems are the same in the extent to which auditing and maintaining dependency chains is a burden. All of Linux from Scratch consists of something like less than 90 distinct dependencies, for instance. When I went to add a token-replacement library to mdbook so I can interpolate variables in a book, Cargo pulled in 287 dependencies. For better or worse, the newer, hotter languages of the day seem to be predicated on extremely small, something single-function, libraries, and thus enormous and arguably intractable dependency trees.

ComradePhil 5y ago

That reminded me of the whole Ayo.js thing: https://github.com/ayojs/ayo https://github.com/ayojs/ayo The NodeJS community somehow tends to attract the worst kind of people.

devmunchies 5y ago

I’ll be using Deno for new projects from now on.

pelasaco 5y ago

again, nothing blocks you to have a better supply chain to your software: Download all dependencies and freeze them, fork the dependencies and groom your fork or have dependantbot or depfu managing your dependencies for you and keep a delay between merging the PRs, have manual review, etc.. You shouldn't be pulling stuff from internet and pushing to production without take a look into that anyway...

shuntress 5y ago

All things are inherently "political" just not always significant enough to be worth considering. The trite ways to say it (ie: "we live in a society" or "actions have consequences") don't really capture the full complexity of human interaction but do somewhat describe the notion that everything you do as an individual affects and is affected by everything everyone else does. Being "political" really means just believing that those effects are too significant to ignore.

raxxorrax 5y ago
What makes everything political? Of course something I do or say can influence others, but it is still not political in the vast majority of instances. Not even non-significantly. Political action is shaping my environment to my desire. Via compromise or war perhaps. What is your definition of it that it applies to everything?
- BlueTemplar 5y ago
  That's just action. What makes it political is if happens to have an effect outside of your home. (And technically even those restricted to the inside will usually end up having some sort of effect outside of your home.)
  - raxxorrax 5y ago
    Hm, I disagree that any effect has to be political. If so the word seems to have little intrinsic meaning.