12 ms·

> (...) but a particularly paranoid interpretation is that this person is setting up for a massive, multi-pronged software supplychain attack. That person migh

> (...) but a particularly paranoid interpretation is that this person is setting up for a massive, multi-pronged software supplychain attack. That person might not be doing it knowingly or on purpose, but regardless of motivations that is definitely what is being done.

whilenot-dev 1y ago
A package "for-each"[0] that depends on a package "is-callable"[1], just to make forEach work on objects? Nope, not buying the goodwill here. [0]: https://www.npmjs.com/package/for-each https://www.npmjs.com/package/for-each [1]: https://www.npmjs.com/package/is-callable https://www.npmjs.com/package/is-callable
- whilenot-dev 1y ago
  To be fair, he himself removed his unnecessary dependency that caused the explosion of dependencies: https://github.com/A11yance/aria-query/commit/ee003d2af54b6bc49a7aba231fedfd0f8b2c8610 https://github.com/A11yance/aria-query/commit/ee003d2af54b6b... EDIT: Oops, he just did the changelog entry. The actual fix was done by someone else: https://github.com/A11yance/aria-query/commit/f5b8f4c9001ba7c7efd20fe6d76bb578c2723de3 https://github.com/A11yance/aria-query/commit/f5b8f4c9001ba7...
- motorest 1y ago
  Older browsers don't support foreach, so it's not like a polyfill is unheard of https://caniuse.com/?search=foreach https://caniuse.com/?search=foreach
  - whilenot-dev 1y ago
    Are you serious here? It isn't a polyfill, it's supposed to work on plain objects which isn't part of the spec at all. Besides that, Array.prototype.forEach is only unsupported in Android Browser 4.3 (from July 2013) and IE8 (from May 2008). Seems like a weird reasoning to add it to packages in 2025.
    - motorest 1y ago
      > Are you serious here? I am. If you check the definition of polyfill, you'll eventually arrive at something like the following: > A polyfill is a piece of code (usually JavaScript on the Web) used to provide modern functionality on older browsers that do not natively support it. https://developer.mozilla.org/en-US/docs/Glossary/Polyfill https://developer.mozilla.org/en-US/docs/Glossary/Polyfill I think we would agree that foreach fits the definition, happy path, and whole purpose of a polyfill. if you read up on forEach, you will notice that Array.prototype.forEach requires objects to be callable. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/forEach https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
      - whilenot-dev 1y ago
        > I think we would agree that foreach fits the definition, happy path, and whole purpose of a polyfill I think you got that all wrong and strongly misinterpret "modern functionality" as some generic library here... Runtimes are developed against a certain spec, in this case ECMAScript, and "modern functionality" is meant as addition to iterations of such a spec. As it happens, iterations of specifications and runtimes are seldomly provided by the same entity, so both are moving forward with newly supported features, or more "modern functionality", individually. This behavior provokes some difficult challenges for developers. For once, they would like to work against the latest spec with its newest features, but, due to the natural dynamic of various entities doing things in different ways, these developers would also need to support older/other runtimes where such a feature is not (yet) implemented natively. Now, to bridge these supported-feature-gaps developers came up with an interesting concept: Instead of waiting and relying on the runtime to support such a new feature, it might be possible to provide an implementation as workaround, hence the "polyfill". So, if something A isn't currently in the spec, nor B even proposed or in discussion to be in the spec, nor C provided by any current runtime (and relied upon by developers), then I'd conclude that such a functionality is not considered to be a polyfill, as it isn't to be seen as workaround for the supported-feature-gaps due to the difference in runtimes.
        1y ago
- karel-3d 1y ago
  ljharb has commit rights (edit: maybe? maybe not. not sure) to nodejs itself https://github.com/nodejs/node/issues/55918 https://github.com/nodejs/node/issues/55918 so.. I don't know. if he wanted to bad he would already

whilenot-dev 1y ago

A package "for-each"[0] that depends on a package "is-callable"[1], just to make forEach work on objects? Nope, not buying the goodwill here. [0]: https://www.npmjs.com/package/for-each https://www.npmjs.com/package/for-each [1]: https://www.npmjs.com/package/is-callable https://www.npmjs.com/package/is-callable

whilenot-dev 1y ago
To be fair, he himself removed his unnecessary dependency that caused the explosion of dependencies: https://github.com/A11yance/aria-query/commit/ee003d2af54b6bc49a7aba231fedfd0f8b2c8610 https://github.com/A11yance/aria-query/commit/ee003d2af54b6b... EDIT: Oops, he just did the changelog entry. The actual fix was done by someone else: https://github.com/A11yance/aria-query/commit/f5b8f4c9001ba7c7efd20fe6d76bb578c2723de3 https://github.com/A11yance/aria-query/commit/f5b8f4c9001ba7...
motorest 1y ago
Older browsers don't support foreach, so it's not like a polyfill is unheard of https://caniuse.com/?search=foreach https://caniuse.com/?search=foreach
- whilenot-dev 1y ago
  Are you serious here? It isn't a polyfill, it's supposed to work on plain objects which isn't part of the spec at all. Besides that, Array.prototype.forEach is only unsupported in Android Browser 4.3 (from July 2013) and IE8 (from May 2008). Seems like a weird reasoning to add it to packages in 2025.
  - motorest 1y ago
    > Are you serious here? I am. If you check the definition of polyfill, you'll eventually arrive at something like the following: > A polyfill is a piece of code (usually JavaScript on the Web) used to provide modern functionality on older browsers that do not natively support it. https://developer.mozilla.org/en-US/docs/Glossary/Polyfill https://developer.mozilla.org/en-US/docs/Glossary/Polyfill I think we would agree that foreach fits the definition, happy path, and whole purpose of a polyfill. if you read up on forEach, you will notice that Array.prototype.forEach requires objects to be callable. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/forEach https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
    - whilenot-dev 1y ago
      > I think we would agree that foreach fits the definition, happy path, and whole purpose of a polyfill I think you got that all wrong and strongly misinterpret "modern functionality" as some generic library here... Runtimes are developed against a certain spec, in this case ECMAScript, and "modern functionality" is meant as addition to iterations of such a spec. As it happens, iterations of specifications and runtimes are seldomly provided by the same entity, so both are moving forward with newly supported features, or more "modern functionality", individually. This behavior provokes some difficult challenges for developers. For once, they would like to work against the latest spec with its newest features, but, due to the natural dynamic of various entities doing things in different ways, these developers would also need to support older/other runtimes where such a feature is not (yet) implemented natively. Now, to bridge these supported-feature-gaps developers came up with an interesting concept: Instead of waiting and relying on the runtime to support such a new feature, it might be possible to provide an implementation as workaround, hence the "polyfill". So, if something A isn't currently in the spec, nor B even proposed or in discussion to be in the spec, nor C provided by any current runtime (and relied upon by developers), then I'd conclude that such a functionality is not considered to be a polyfill, as it isn't to be seen as workaround for the supported-feature-gaps due to the difference in runtimes.
      - 1y ago
karel-3d 1y ago
ljharb has commit rights (edit: maybe? maybe not. not sure) to nodejs itself https://github.com/nodejs/node/issues/55918 https://github.com/nodejs/node/issues/55918 so.. I don't know. if he wanted to bad he would already