15 ms·
It's always worth mentioning that those packages stem from the effort of one dedicated npm spammer[1] to weasel his way into as many node_modules directories as
by lvncelot 3y ago
It's always worth mentioning that those packages stem from the effort of one dedicated npm spammer[1] to weasel his way into as many node_modules directories as possible. There's also packages for ansi-colors (no, not one package for all colors, one package for each color) and god knows what else. These then get jammed into any cli tool or other half-way sensible looking package, all referencing each other obviously - and any "real" project is just a single innocuous dependency away from having dozens of jonschlinkert packages.
[1] https://www.npmjs.com/~jonschlinkert https://www.npmjs.com/~jonschlinkert
- jevoten 3y agoAchieving supply-chain security by controlling every link in the chain. This Jon is very noble.
- jbverschoor 3y agoPackages should specify their entitlements.. network access, file access, executing system calls, being able to monkey patch things, accessing packages outside their own.
- vorticalbox 3y agoDeno has a few of these by default an application has no access to the filesystem, env or network. You can allow only reading or only writing for files and you can also define what domains are allowed.
- jbverschoor 3y agoSure it's a huge step forward. But that's on an application level, which honestly I can do with sandbox-exec on macOS (see below). In Deno, all permissions would still propagate down to the dependencies. (version 1) (deny default) (allow file-read* (subpath "~/Downloads") ) (allow network-outbound (remote tcp "localhost:80") ) or (version 1) (allow default) (deny network*) or # start an airgapped shell, and play around in there.. sandbox-exec -p "(version 1)(allow default)(deny network*)" bash
- vorticalbox 3y agoThere have been a few GitHub issues open but from what I can tell it's in the "not technically possible with V8 VM" category
- smolder 3y agoRealistically I think they long ago should have been banned from npm, with all submissions deleted.
- fmx 3y agoWhen I first heard of the is-odd and is-even NPM packages I was sure they were a joke, yet there we are: 200K weekly downloads! Publishing the packages may have been the effort of one spammer, but many developers obviously chose to use them - that's the part that boggles my mind.
- lvncelot 3y agoWell, look at one of the dependents: https://www.npmjs.com/package/handlebars-helpers https://www.npmjs.com/package/handlebars-helpers - certainly a more useful npm package, but by the same author. Seldom do people actually type `npm install is-even` - there's just a jungle of transitive dependencies that can be traced back to one of jonschlinkert's many packages, which then circles back to something inane as `is-even` or `ansi-red`. I once ran a simple grep in some of my node projects - most of them had a jonschlinkert package in node_modules, certainly not through any (direct) choice of my own.
- spacechild1 3y agoCheck out this very useful utility: https://github.com/mitsuhiko/is-jonschlinkert https://github.com/mitsuhiko/is-jonschlinkert :)
- bryancoxwell 3y agoI love the release notes: > It exists.
- password4321 3y agoPossibly related: https://github.com/SukkaW/nolyfill https://github.com/SukkaW/nolyfill vs. ljharb and nodejs 4
- runarberg 3y agoI recently came across this issue (https://github.com/import-js/eslint-plugin-import/issues/2132 https://github.com/import-js/eslint-plugin-import/issues/213... and https://github.com/import-js/eslint-plugin-import/issues/1810 https://github.com/import-js/eslint-plugin-import/issues/181...) and man that person has really found him self a hill. What is a bit worrying though is that he is an active member and contributor to TC-39. Meaning that this kind of community hostility is very much alive among the people who rule JavaScript.
- MyFirstSass 3y agoSeriously fuck this dude leeching on the open source community. He's not even a technical guy but has a background i marketing and is directly trolling various Github issues : https://news.ycombinator.com/item?id=28661094 https://news.ycombinator.com/item?id=28661094 I've always wondered why node-modules and npm required such an insane amount packages so quickly, and now i know why, people like him that use their 10.000 ridiculous packages to boost their career or do whatever self serving community destroying thing they can think off that day. There really should be a way to ban people doing this shit.
- yreg 3y agoThe author hasn't forced you to import their package. What's there to ban apart from maybe polluting the common namespace?
- posix86 3y agoIt's more a statement about the community than him imo. Or maybe about what npm allows to be published. Nobody forced you to use is-odd, yet it's downloaded 200k a week, why? Because js' developer community doesn't know any better
- geodel 3y agoExactly right. Its clever way of deflecting blame that whole community should share by piling on this particular person.
- ycombobreaker 3y agoThis really sounds like victim-blaming. The community is vulnerable to somebody publishing asinine modules, which should be addressed. However, this individual is still the perpetrator.
- kardos 3y agoA lot or these downloads may be CI systems running automatic tests.
- AussieWog93 3y agoThis is the first time I'm hearing about this guy, but not sure why there's so much hate. It looks like he came from a non-technical background, and is trying to make the language more noob friendly. Compare the pair: if isEven(n) { } if (n % 2) == 0 { } I guarantee you my wife would have no idea what the second snippet even means.
- numpad0 3y agoif !(n & 1) {} // rightmost bit(LSB) is always `true` for odd integers
- extrememacaroni 3y ago[flagged]
- btdmaster 3y agoFor code golf purposes, ~n&1 works fine
- cperciva 3y ago// FIXME: This breaks on negative numbers on ones-complement machines
- MrJohz 3y agoThere's an argument to be made for writing functions like `isEven` and using them instead of n%2. There's an argument that the JS standard library, or other comprehensive util libraries like Lodash or Underscore should include these functions. The problem here is introducing separate dependencies for each of these tiny functions. Dependencies are code that you haven't written, but are still your responsibility. For a lot of things, that's a good tradeoff: if you don't have the expertise in a specific area, or if you can offload work to a dependency that you trust, that's great. But for micro dependencies like this, it's usually a bad deal - you don't get anything in return (seriously, how hard is it to write your own isEven function?) but you have to rely on a third party to be secure, to not push anything accidentally broken, to not change the API, etc. (I think it's also worth pointing out that your wife is not a paid programmer. Software development should be accessible, but this isn't the only goal, and I think it's reasonable to assume that most programmers either understand the n%2 idiom, or know enough to be able to find help on the subject.)
- School-Cotton 3y agoIt seems very uncharitable to describe someone as a “spammer” because their philosophy on the proper size of units of code reuse is different from yours.
- Y_Y 3y agoIt seems overly charitable to me to frame the dispute in those terms. You and I might differ as to the appropriate amount of vermouth in a martini or pineapple on a pizza and I won't worry much about it, within reason. There's a limit though! I think up to about 10% pineapple by weight is reasonable for a Hawaiian, if you choose 0 or 20% then we'll have no issue. If you went to 30% I don't think I could stop myself writing a libellous remark on hn. Anything about 50% and I would be morally forced to denounce you to the proper authorities. About 80% is where the nightmares begin.
- hex4def6 3y agoAt a certain point, isn't it just grilled pineapple with pizza crumbs?
- pc86 3y agoEven if you think having a dependency load `is_even()` is a good thing, surely you can see how it's pretty hard to defend having a completely separate and nearly identical `is_odd()` rather than just `!is_even()`
- tentacleuno 3y ago
- shp0ngle 3y agoYou may not like it, but this is what 10x performance looks like
- joenot443 3y ago> Several years ago, just before my 40th birthday, I switched careers from sales, marketing and consulting to learn how to program, with the goal of making the world a better place through code [1] It checks out, sales/consulting folks are pretty infamous for their tendency to abuse metrics. The metric here is npm downloads and Github stars. The strategy does mean that he's _technically_ not inaccurate in claiming this on his LinkedIn - > NASA, Microsoft, Google, AMEX, Target, IBM, Apple, Facebook, Airbus, Mercedes, Salesforce, and hundreds of thousands of other organizations depend on code I wrote to power their developer tools and consumer applications. I encountered this type a lot in college consulting groups, it's a little funny seeing one make their way to the OSS community. [1] https://github.com/jonschlinkert https://github.com/jonschlinkert
- whaleofatw2022 3y agoYeah but this might make him the Patient Zero for modern tech influencing and blogspam.
- galangalalgol 3y agoAnyone know if this has spread to crates.io yet? I see plenty of name squatting, but I haven't run into real crates trying to insert themselves into everything. Namespaces are sorely needed, including some semi-official ones. candi::rand would be reasonable for candidates to enter std. Watching the battles over tokio getting into candi would be fun.
- internetter 3y ago> Watching the battles over tokio getting into candi would be fun. What would be the argument for this? It's my understanding that the lack of a default runtime is considered a strength
- jd24 3y ago> To date, I've created more than 1,000 open source projects This dude is counting each one as a project hahaha
- pc86 3y agoSo what excuse do the people installing these packages have?
- mbb70 3y agoAnother classic from jon is the venerable https://www.npmjs.com/package/isobject https://www.npmjs.com/package/isobject coming in at 30,000,000 weekly downloads for `function(val) { return val != null && typeof val === 'object' && Array.isArray(val) === false; }` But honestly, having seen "TypeError: Cannot read properties of null" enough times, I give it a pass. https://npm-stat.com/charts.html?author=jonschlinkert https://npm-stat.com/charts.html?author=jonschlinkert paints a pretty crazy picture
- orenlindsey 3y agoThat's hilarious. The best part is that he didn't even try to make good packages (not that hard) but just took the lazy route.
- geodel 3y agoWell one reason could be this software proverb: Good programers are lazy programers.
- mkgeorge7 3y agoI'm relatively new to the world of node. Is there anything objectively wrong or should I say nefarious with that this Jon person is doing? I guess, what's the issue here, from your perspective, if he's creating package (that albeit are simple) but some some amount of utility?
- lolc 3y agoIn my view it is objectively wrong to create trivial npm packages yes. If we look at the npm ecosystem as a commons, that person is polluting it. Of course you could say it's namespaced to one account, so what's the harm? In my view, plenty: - package searches will show these packages due to the inflated usage from transient deps. - installs are slower due to the package noise. - increased attack surface when they are used - cultural normalization of throwaway packages Probably more.
- johannes1234321 3y agoEach dependency causes work for any serious use. You got to check license, got to check for updates, risk supply chain attacks (package disappearing, package replaced with bad code, ...) etc. which causes longer term cost. In addition abstraction of trivial checks, makes it harder to see the limitations of said routine. How well does it work on numeric strings? How well on large numbers where float properties cause issues?
- Jasper_ 3y agoMy favorite is the existence of both https://github.com/jonschlinkert/ansi-gray https://github.com/jonschlinkert/ansi-gray and https://github.com/jonschlinkert/ansi-grey https://github.com/jonschlinkert/ansi-grey that do the exact same thing.
- johnfn 3y agoIt's weird to me that in every other comment thread on Hacker News, people say "good software should do one thing and do it well". And then the topic moves to NPM, and suddenly everyone loses their mind?
- lolc 3y agoHaha ok do something substantial! It's implied.
- jrockway 3y agoA little copying is better than a little dependency.
- throwitaway1123 3y agoThis is part of the UNIX philosophy, but sometimes this gets taken way too far. There is of course the UNIX command "yes", which literally just prints the character "y" over and over again (to skip interactive prompts).
- ericbarrett 3y agoGNU yes will actually repeat any string—the default is of course "y". So it's very handy for scripting, and not really as single-purpose as you'd think.
- throwitaway1123 3y agoYeah it's definitely useful. Still a bash one liner though: function yes { while true; do echo "${1:-y}"; done }
- rini17 3y agoalso, it's actually faster than reading /dev/zero if you need some filler data hahahaha