43 ms·

So the “prank”, as called in the article, used the same flaw that allowed someone to do it last January. His apology appears deleted along with the repo. Was t

• chewmieser 3y ago
  Why is it still possible to do when it’s been done I think 2 other times? How crazy that there’s not like a limit or some kind of basic check to prevent the upload or something? Honestly at this point it seems to be a failure on NPM’s part. People should really direct their anger to the maintainers at this point
  • 0cf8612b2e1e 3y ago
    What is the correct mitigation for this? Packages can have large dependency trees, so outside of putting an arbitrarily high upper limit, what is the fix?
    • vitiral 3y ago
      I think you named at least one reasonable fix: an upper limit. And it's not really arbitrary. You can count the dependency tree of every package and get the P99, exclude joke packages and get the max of the rest. Set the limit around there with an error message to open a bug if you need more, grandfathering legit old large packages with some kind of admin-level exception. The number of people actually needing more will be incredibly tiny. Service those folks individually to avoid pain.
      • joemi 3y ago
        It's still arbitrary because P99 is an arbitrary percentage. Why not P97 or P90? Or P99.9? And if you have an arbitrary cutoff but make exceptions for _some_ people who are over that cutoff, you're opening yourself up to two things you don't want: more work for yourself to review the special cases, and more complaining from people. Better to have a rule apply to everyone equally.
        • vitiral 3y ago
          The cutoff is more about "this is the number of bug requests for exceptions" rather than some kind of technical limit. When it's a staffing limit the question becomes less arbitrary.
      • hombre_fatal 3y ago
        Your policy wouldn't change anything here. The person made thousands of modules that look like `@everything/sub-chunk-{id}`, each depending on N modules. Those sub-chunk modules, together, depend on all NPM modules. Whatever upper limit you come up with, anyone can do this by setting N to your upper limit. The problem here isn't that you can create modules that depend on other modules. If there's a problem at all, it's that the NPM's yank policy could be improved.
        • vitiral 3y ago
          My suggestion was for N=recursive deps (dependency TREE), so yes it would affect the "everything" package, and likely many of its chunks And I agree about yank! I just think you could implement multiple reasonable solutions here
          • hombre_fatal 3y ago
            It would affect the everything package, but not the issue since the issue is caused by npm's policy + simply creating thousands packages with, say, 5 dependencies that cover all of the module space. That they rolled all of those submodules into one big everything package is just a gimmick, not a source of the problem.
    • j-bos 3y ago
      This seems reasonable: https://news.ycombinator.com/item?id=38874889 https://news.ycombinator.com/item?id=38874889
• starttoaster 3y ago
  > Was there a legitimate purpose or is he just a troll? Call attention to a real issue that should be solved by the ecosystem so that people cannot do it in the future? In my opinion it is not useful or even sane to expect people to just _not_ do annoying things if you develop systems that allow people to do things that annoy you with them. Design and build systems that assume people will be trolls, and make it so people cannot so easily troll you with them. Failing that, there's nobody to point the finger at besides the person or people who made it possible.
  • dahdum 3y ago
    I’m just curious about the intent, as the article implies it was a deliberate prank. That would definitely have professional repercussions. We can laud him for drawing more attention to a major problem, but many (perhaps most?) potential employers may not see it as a positive.
    • starttoaster 3y ago
      What's your intent by assuming what these hypothetical employers would think? They stated in the article that the intent was to raise awareness, not to troll. People are just assuming they're lying about their intent, but I don't see much point in trying to uncover a grand conspiracy here, fix the problem with npm.
      • dahdum 3y ago
        I was hoping they had a reason other than “for the attention and lulz” that would be explained in the repo. I guess not.
        • starttoaster 3y ago
          There isn't really any conceivable reason other than for lulz is there, though? That's the whole point. Nobody NEEDS this, so the Node ecosystem needs to fix this in such a way where creating an everything package isn't even possible. The only attention this person deserves is whatever amount of attention is required to get people that work on NPM to work on a fix. I'm sorry for all the people that feel the need to act attacked by this, but frankly if nobody shines a light and causes some pain by being a lawful-evil prankster, the people working on Node will never bother to fix it. As is evidenced by the fact that it is possible.