5 ms·

Seriously fuck this dude leeching on the open source community. He's not even a technical guy but has a background i marketing and is directly trolling various

Seriously fuck this dude leeching on the open source community. He's not even a technical guy but has a background i marketing and is directly trolling various Github issues : https://news.ycombinator.com/item?id=28661094 https://news.ycombinator.com/item?id=28661094 I've always wondered why node-modules and npm required such an insane amount packages so quickly, and now i know why, people like him that use their 10.000 ridiculous packages to boost their career or do whatever self serving community destroying thing they can think off that day. There really should be a way to ban people doing this shit.

yreg 3y ago
The author hasn't forced you to import their package. What's there to ban apart from maybe polluting the common namespace?
posix86 3y ago
It's more a statement about the community than him imo. Or maybe about what npm allows to be published. Nobody forced you to use is-odd, yet it's downloaded 200k a week, why? Because js' developer community doesn't know any better
- geodel 3y ago
  Exactly right. Its clever way of deflecting blame that whole community should share by piling on this particular person.
  - ycombobreaker 3y ago
    This really sounds like victim-blaming. The community is vulnerable to somebody publishing asinine modules, which should be addressed. However, this individual is still the perpetrator.
- kardos 3y ago
  A lot or these downloads may be CI systems running automatic tests.
  - darkwater 3y ago
    They clearly are, but this still means a not negligible amount of softwares have those packages in their dependencies.
- sam_bristow 3y ago
  Maybe someone needs to do a website in the same spirit of https://youmightnotneedjquery.com https://youmightnotneedjquery.com except youmightnotneedjonschlinkert.
- whstl 3y ago
  Notice that most dependents of his tools are: 1) his own project, 2) abandoned beginner projects. As some people mentioned, most of the usage of is-even is by tools made by this person. But the other part is that, he made quite a few development tools for beginners that scaffold new projects and pull lots of his packages as dependencies (especially the handlebars helper), which heavily inflates the number of "Dependents" in NPM. The other issue is that, in the past, he managed to include some of his less-useless packages in some semi-popular tools.
bee_rider 3y ago
I mostly write in languages without package managers so it is possible that my expectations are just wrong, but is there no way of showing your dependency graph when using npm?
- christophilus 3y ago
  Here are some popular ones. Now, in two of these cases, they can be dev-dependencies, but even there, it makes me angry, since all of those deps have to be downloaded to my machine, and can run any random code they want at install time (which is why Node projects should always be run in some kind of sandbox). https://npm.anvaka.com/#/view/2d/jest https://npm.anvaka.com/#/view/2d/jest https://npm.anvaka.com/#/view/2d/tailwind https://npm.anvaka.com/#/view/2d/tailwind https://npm.anvaka.com/#/view/2d/aws-sdk https://npm.anvaka.com/#/view/2d/aws-sdk
  - throwitaway1123 3y ago
    > can run any random code they want at install time (which is why Node projects should always be run in some kind of sandbox). You can install with the --ignore-scripts flag. Or set the option globally in your npm config file.
School-Cotton 3y ago
Isn't the post you linked to about a different person?
paulddraper 3y ago
> There really should be a way to ban people doing this shit. ??? There is. It's called "doing nothing." It takes work to add a dependency to your project; they don't spring out of nothing.

yreg 3y ago

The author hasn't forced you to import their package. What's there to ban apart from maybe polluting the common namespace?

posix86 3y ago

It's more a statement about the community than him imo. Or maybe about what npm allows to be published. Nobody forced you to use is-odd, yet it's downloaded 200k a week, why? Because js' developer community doesn't know any better

geodel 3y ago
Exactly right. Its clever way of deflecting blame that whole community should share by piling on this particular person.
- ycombobreaker 3y ago
  This really sounds like victim-blaming. The community is vulnerable to somebody publishing asinine modules, which should be addressed. However, this individual is still the perpetrator.
kardos 3y ago
A lot or these downloads may be CI systems running automatic tests.
- darkwater 3y ago
  They clearly are, but this still means a not negligible amount of softwares have those packages in their dependencies.
sam_bristow 3y ago
Maybe someone needs to do a website in the same spirit of https://youmightnotneedjquery.com https://youmightnotneedjquery.com except youmightnotneedjonschlinkert.
whstl 3y ago
Notice that most dependents of his tools are: 1) his own project, 2) abandoned beginner projects. As some people mentioned, most of the usage of is-even is by tools made by this person. But the other part is that, he made quite a few development tools for beginners that scaffold new projects and pull lots of his packages as dependencies (especially the handlebars helper), which heavily inflates the number of "Dependents" in NPM. The other issue is that, in the past, he managed to include some of his less-useless packages in some semi-popular tools.

bee_rider 3y ago

I mostly write in languages without package managers so it is possible that my expectations are just wrong, but is there no way of showing your dependency graph when using npm?

christophilus 3y ago
Here are some popular ones. Now, in two of these cases, they can be dev-dependencies, but even there, it makes me angry, since all of those deps have to be downloaded to my machine, and can run any random code they want at install time (which is why Node projects should always be run in some kind of sandbox). https://npm.anvaka.com/#/view/2d/jest https://npm.anvaka.com/#/view/2d/jest https://npm.anvaka.com/#/view/2d/tailwind https://npm.anvaka.com/#/view/2d/tailwind https://npm.anvaka.com/#/view/2d/aws-sdk https://npm.anvaka.com/#/view/2d/aws-sdk
- throwitaway1123 3y ago
  > can run any random code they want at install time (which is why Node projects should always be run in some kind of sandbox). You can install with the --ignore-scripts flag. Or set the option globally in your npm config file.

School-Cotton 3y ago

Isn't the post you linked to about a different person?

paulddraper 3y ago

> There really should be a way to ban people doing this shit. ??? There is. It's called "doing nothing." It takes work to add a dependency to your project; they don't spring out of nothing.