Slashdot Mirror
How One Dev Broke Node and Thousands of Projects In 11 Lines of JavaScript (theregister.co.uk)
An anonymous reader quotes an article written by Chris Williams for The Register: Programmers were left staring at broken builds and failed installations on Tuesday after someone toppled the Jenga tower of JavaScript. A couple of hours ago, Azer Koculu unpublished more than 250 of his modules from NPM, which is a popular package manager used by JavaScript projects to install dependencies. Koculu yanked his source code because, we're told, one of the modules was called Kik and that apparently attracted the attention of lawyers representing the instant-messaging app of the same name. According to Koculu, Kik's briefs told him to take down the module, he refused, so the lawyers went to NPM's admins claiming brand infringement. When NPM took Kik away from the developer, he was furious and unpublished all of his NPM-managed modules. 'This situation made me realize that NPM is someone's private land where corporate is more powerful than the people, and I do open source because Power To The People,' Koculu blogged. Unfortunately, one of those dependencies was left-pad. It pads out the lefthand-side of strings with zeroes or spaces. And thousands of projects including Node and Babel relied on it. With left-pad removed from NPM, these applications and widely used bits of open-source infrastructure were unable to obtain the dependency, and thus fell over.
See this is the exact scenario I've talked about before, typically when learning a new coding language. Dependancies and libraries are BAD. 1: because they remove the need to understand what's actually going on (premade functions for example) 2: because some asshat could yank them away and leave your project broken, then YOU have to figure out how to replace the dependencies. I get not reinventing the wheel. But you really need to pay attention to what your code is dependent on and remove that dependency if possible
So, what have we learned?
External dependencies are unsustainable;
JavaScript is unmaintainable;
Dozens of mainstream projects relying on a trivial bit of string padding code from an external JavaScript dependency is unconscionable.
This is just hilarious. What a shit-show, from the bullshit legal threat to the developer's hissy fit to the dependence on an apparently obscure package to implement (lol) left-padding.
Reminds me of someone I knew who was wringing his hands for a few days over which license to use for his super-awesome R function library. He asked me for advice, and I told him that it's ~30 lines of syntactic boiler-plate code so get over yourself and just put it in public domain so that the two people who ever use it can do so easily. But of course, he had to deeply consider the political implications of which flavor of "freedom" he would support.
"They were pure niggers." – Noam Chomsky
Don't know who they are or what they do, but fuck them and boycott whatever it is they sell.
Those who do not learn from commit history are doomed to regress it.
Just kidding, I have no problem with Javascript. By the way, that summary was confusing as hell.
One of the beauties of JS is that it's easy to provide your own functions, so as long as it's only left-pad missing, you could provide your own, right?
function left_pad(str, min_length, pad_char){
if(str.length min_length){
str = Array(min_length - str.length).join(pad_char) + str;
}
return str;
}
(note, I did not do any sanity/error checking in the function, so do not simply copy/paste, please fill it out if you intend to use it)
Everything is one letter away of meaning something in some language.
Dependencies are unavoidable, specially on big projects - you are not expected to reinvent the wheel every time you code.
Now, having a dedicated library dependency for padding strings is a bit of a stretch though...
Kik is one letter short of being kike (a racist name for a Jewish person). How brilliant.
It's also one letter short of being "kick" (an racist action to be performed on a Jewish person). How brilliant.
I've always thought this interconnected pile of stuff, linking across a bunch of domains was lazy, dangerous, and likely to be very brittle.
Sorry, but the interwebs have shown me I can't afford to trust arbitrary code from all over the place, which can change at a moments notice, and which I know nothing about.
If you've created an infrastructure where tons of stuff breaks because some asshole corporation forces some guy to say "fuck you, you can't have my code", you have a terrible mess. What happens if someone adds some malicious code?
What I find really odd is they've over-ruled him and said "no, you can't un-publish your own stuff, we own it". So, what, they've decided his stuff was too important to still be his own? So he got fucked because of corporate assholes only to have his copyright infringed?
Jenga tower indeed, it sounds like the state of the art is a bunch of brittle dependencies controlled by a few places, and subject to causing a shit top of things to happen when someone makes a change.
This reminds me of a company I worked at which had a universal build system ... everything build from scratch every day and wouldn't build if any of its dependencies didn't build. So when some guy broke a components 3 components upstream, nobody could get anything compiled because the system was too stupid to go with the last known good ... and hundreds of developers sat around all day going "but, what do you mean we can't do anything because some guy checked in shit code".
Wow, just wow.
Steaming Heaps of Innovative Technology.
Lost at C:>. Found at C.
So you say everybody should write their own buggy and incomplete reinvention of the wheel?
Yes, probably most of his libraries aren't longer than 2000 lines of code, and therefore are pretty replaceable, but I don't think that writing your own libraries will decrease the total number of bugs, it will rather increase them.
Bullshit.
Dependencies and libraries are fine. If you want to use SSL encryption in your software you should try and re-implement it all, because while SSL libraries have been having security issues in the last few years there's almost zero chance you make something that doesn't have bigger ones. Multiply that by all the domain specific pieces of code you need.
Not having to understand what's actually going on is a feature not a problem.
What is retarded is using a dependency that exists out in the internet somewhere only, so that your code breaks if some random internet service disappears. As long as you have your own copy of the dependency it's fine. Some asshat can't yank them away since you have your own copy that doesn't magically stop working. Obviously you want the source code, or at the very least the source code escrowed somewhere that you obtain if the provider vanishes in the future.
I don't think this proves libraries per-se are bad, but blindly depending on out-of-house software repositories for every build or (worse) every startup/deploy is crazy.
We're a Java house (go ahead, get your ki[c]ks in...), and we use around 100 open source libraries. They're all mirrored locally in an Ivy repository we maintain. No new versions get checked in unless they've passed a reasonable level of scrutiny, and nothing gets deleted unless we delete it.
Damn bossy underwear!!!
It is 2016. You need to use libraries. You just copy them to your local repo so they are in a known state if you use them.
Does anyone know when this gets fixed and what the plan is?
You could try to read the article.
To fix the internet, Laurie Voss, CTO and cofounder of NPM, took the "unprecedented" step of restoring the unpublished left-pad 0.0.3 that apps required. Normally, when a particular version is unpublished, it's gone and cannot be restored. Now NPM has forcibly resurrected that particular version to keep everyone's stuff building and running as expected.
And your nick is one character away from including the word "reamer", and two letters away from being "screamer".
It is simply not possible to exclude every word which is one or two letters away from offending some random idiot who thinks being one letter away is the same thing.
People can give something a name which is totally innocuous to them and which someone else is going to get into a hissy fit about.
So, what's more likely, he had no idea some random guy on the interwebs would make the comparison to a racial slur, or he used a word which sounded cool to him?
Lost at C:>. Found at C.
Yeah, real programmer treat integers as byte arrays.
You kids and your new fangled pythons don't know how good ya'll have it.
Dependencies are unavoidable, true, but it's a good practice to vet libraries before you include them and make sure they're worth the risk.
The risk with Open Source libraries is usually long term maintenance - will the project be maintained for the lifetime of my project? If the project is not maintained, is it something you're willing to take on and will the license and community let you fork it? If not, there's risk.
You also have the risk we see here - ideology trumping pragmatism (that's a nice way of saying the developer had a fit and took his toys away for reasons even he doesn't fully understand). In those cases, you also have the chance to fork, assuming the license/community allows it.
For trivial operations, such as left padding, it's almost never worth the risk to use a library unless it's part of the language's standard library. Sure, don't write your own FFT or ORM, but if you can code a function in a few minutes for a well defined problem, there's no reason to add an external dependency.
-Chris
If you write *anything* that assumes the perpetual existence of a linked library from somewhere on the internet, you deserve what you get.
Most kids these days don't remember a time where internet access required a dial-up modem -- or it wasn't a 100% certainty it would be available.
If telephones are outlawed, then only outlaws will have telephones.
Nonsense. Laughable, even. Quality programmers can build anything. If they're wise, they will.
I guess you never worked with code then, eh? It is not about whether they can or cannot - is about the resources involved. Writing and testing a production-level software library is not a trivial task. It takes time.
Again, this does not apply to string padding, which is usually resolved on a couple lines of code on the language of your choice...
It's fucking unbelievable how much trouble JavaScript has caused for so many people.
Let's ignore how fundamentally broken it is, as a programming language, in almost every respect. That includes its fucking awful type system, its total lack of real OO (sorry, prototypes are complete shit), its ultra shitty standard library (which is why NPM and this problem exist in the first place), and similar problems.
JavaScript has allowed too many unskilled cranks to shit out way too much broken code. It was one thing when they did it client-side, where it was isolated. Now it's being done server-side, and it's a motherfucking disaster!
Worse, JavaScript has enabled the web advertising industry. JavaScript makes it trivial for them to track your every move online. If you don't want to fall victim to it, then you have to waste your time disabling it everywhere by default, and selectively enabling it where you need it.
JavaScript needs to go.
If you really need to use a scripting language server-side, use Lua, or Python, or even goddamn Tcl. All three of them are better than JavaScript in every way.
And your nick is one character away from including the word "reamer", and two letters away from being "screamer".
I got the nickname "Reamer the Screamer" in the engineering class at junior high school. My model car required a larger opening to fit the CO2 cartridge ("reamer") and it whistled down the string ("screamer"). I never liked that nickname as it fit the reputations of several girls quite well.
... I hope you're kidding. Don't reinvent the wheel - if someone else has already written the code then there's no reason to re-write it. That's a huge waste of man hours. Instead you should package all dependencies in such a way that they can be retrieved without requiring the other guy to still be offering it. Yes, that means a snapshot of the version you rely of should be in your repository because you also can't guarantee that a given version will be available as long as your own project is.
Ironically, it may be Kik's attorneys that acted improperly here. Trademark law allows similar names to be reused for different fields of use, so long as there is not a possibility of confusion/loss of market. Here I seriously doubt that anyone would confuse a Javascript module with a chat application. So quite possibly this was a bogus assertion in the first place, which ended up causing serious damage to a lot of folks.
It's a bit like asking the bum in the alleyway to hold the keys to your business for you over nights, instead of carrying them in your own pocket.
The AC is too busy to respond, he's currently fixing the 9999999 security flaws in his hand-rolled SSL library.
No, real programmers use a magnetized needle to manipulate bits in memory directly. #notruescotsman
Thou shalt always mirror your dependencies. Never assume that everything will always be available. That's continuous integration 101.
Second paradigm: mirror even your dependencies source code, if you can.
Stupidity is the root of all evil.
Well, I suppose that still means his library has fewer flaws than OpenSSL does, so maybe he is doing something right.
Using other people's libraries is fine; you just need to keep your own copy of them instead of dynamically-linking (or hotlinking, in the case of Javascript web shit).
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
What a crock of shit. Do this and you increase your development time 1000-fold. It's stupidity to think that just because someone uses a dependency that they're incapable of understanding it and it blows my mind that this absolute garbage has been voted up. No sane developer would tell you this.
BeauHD. Worst editor since kdawson.
"Dependencies are unavoidable, true, but it's a good practice to vet libraries before you include them and make sure they're worth the risk."
But that's not what is being said. What is being said is "dependencies are bad, you shouldn't have them" which is just ridiculous ideological bullshit. If nobody used dependencies half the software today wouldn't exist in any stable form because people would still be testing and debugging their newly-invented wheels.
BeauHD. Worst editor since kdawson.
It's fucking unbelievable how much trouble plumbing has caused for so many people.
Let's ignore how fundamentally broken it is, as a technology, in almost every respect. That includes its fucking awful historical association with toxic lead, its total lack of real modularity (sorry, reservoirs are complete shit), its ultra shitty set of mutually incompatible pipe sizes, materials, and connections (which is this problem exist in the first place), and similar problems.
Plumbing has allowed too many unskilled cranks to shit out way too many leaky pipes. It was one thing when they did it in Ancient Rome, where it was isolated to a fountain in the town square. Now it's being done in people's houses, and it's a motherfucking disaster!
Worse, plumbing has enabled the for-profit water supply industry. Plumbing makes it trivial for them to track every drop of water you use. If you don't want to fall victim to it, then you have to waste your time turning off a bunch of valves, and digging wells everywhere.
Plumbing needs to go.
If you really need to use a water delivery technology, use a river, or a pond, or even a goddamn barrel . All three of them are better than plumbing in every way.
I hope you're kidding. Don't reinvent the wheel - if someone else has already written the code then there's no reason to re-write it.
I hope you're kidding, and the present situation makes an excellent example of why.
Tracking down Open Source dependencies has become a complete nightmare, in many cases, because far, far too many devs unfortunately take your advice to heart. No, we shouldn't roll our own bigmath libraries, or nosql implementations. But what lazy-assed devs would import an external dependency for something as trivial as padding a string? Oh, right - Apparently thousands of them. Gee, I wonder why the business world doesn't take us seriously, despite offering them our work for the low, low price of "free"?
This. Exactly this. Someone needs to allow your score to go to 6 for combating the stupidity around here.
BeauHD. Worst editor since kdawson.
Because iterating backwards is the same as forwards?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
... I hope you're kidding. Don't reinvent the wheel - if someone else has already written the code then there's no reason to re-write it. That's a huge waste of man hours. Instead you should package all dependencies in such a way that they can be retrieved without requiring the other guy to still be offering it. Yes, that means a snapshot of the version you rely of should be in your repository because you also can't guarantee that a given version will be available as long as your own project is.
Exactly. And this is the very reason we went to using Maven and a private Nexus server. Nexus will go out periodically and find all the security patches, bug fixes, etc. (and upgrades, if you want them) for all of your dependencies, and keep a local copy. If the upstream repository goes dark (this actually happens a lot), you still have a copy of the latest version.
I'm sure there are other similar system that do the same thing. How are people managing their "nuget" packages?
"Somebody has to do something. It's just incredibly pathetic it has to be us."
--- Jerry Garcia
What an absurd statement. You only need to understand the implementation details if you have the responsibility of changing or fixing something - the whole basis of high(er) level languages is that you don't need to understand how absolutely everything works in order to use it; and the same applies to third party libraries.
Yes, it's the Hipster False Switcheroo Fallacy. Also known as satire.
"Mr. Swift, cease this frippery at once! I fail to see what infant cannibalism has to do with wealth inequality and class relations in Ireland!"
And how dare you, sir or madam or other. I'll have you know I've put countless man-or-woman-or-other-hours into my artisanal gluten-free bread.
Also, how dare you, Slashdot! Putting a squiggly red underline under "artisanal" in 2016. This is disappointingly regressive!
Try writing an application that handles all the common image file formats, (at least JPEG, GIF, PNG and BMP) and get back to us.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
For trivial operations, such as left padding, it's almost never worth the risk to use a library unless it's part of the language's standard library. Sure, don't write your own FFT or ORM, but if you can code a function in a few minutes for a well defined problem, there's no reason to add an external dependency.
Generally I've found that anything taking less than two days (one day for writing, one day for testing) is worth rewriting yourself instead of adding a dependency (arguably, anything taking less than a week is worth rewriting, depending on the quality and stability of the dependency).
"First they came for the slanderers and i said nothing."
FYI, to give an idea of how long that would take, I did that a while ago for GIF, and between understanding the documentation and writing the code and debugging, it took 40 hours (my original estimate was ~8 hours ha!). So extrapolating based on that, the time required for the total collection would be 160 hours, pad it up to 200 hours to account for complications. Given the relative stability of the image libraries, it's unlikely to be worth re-implementing them.
"First they came for the slanderers and i said nothing."
real programmers swipe code from SO and compile it without attribution - saying "I wrote all of this"
I have an SVN repo on the same server that hosts my sites. All code is linked from there for js stuff.
I have a private side as well that I use to deploy all server side code from. Works quite well.
-nb
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
What is being said is "dependencies are bad, you shouldn't have them"
It's true. It's also true to say 'reinventing the wheel is bad, you shouldn't do it'. Eventually, you have to pick the lesser of two evils, but neither solution is particularly enjoyable.
I am TheRaven on Soylent News
The script shouldn't use while loop at all. Instead, it could be replaced with a simple for loop instead because the loop number is defined.
for (var i=0; i<(len-str.length); i++) { ... }
Back to the topic, I think the word kik is a trademark - http://tmsearch.uspto.gov/bin/... - and it is still enforcible. If you look at the Good and Services, it may be the reason why the developer should not use the name or he could be sued...
Define "need". Explain to me why I need to understand how a library works in detail. We use a geometry library that uses NURBS, which I haven't bothered learning enough to debug the library. We use a JPEG library, and I really haven't bothered to learn how JPEG works. Add up all the third-party libraries we use, and the company would never have gotten off the ground if we'd had to write all those ourselves.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
You got me interested, and with efficiency you can never be sure until you time it, so I wrote a program to time it. Looping from zero to a billion, with an assignment inbetween. Then I recompiled and ran it again, this time going backwards to zero. Here are some times (in milliseconds):
Going up: 32453 / 32536 / 32232 / 32604
Going down: 32587 / 32416 / 32216 / 32466
There seems to be no difference at all in either direction. Code is here.
"First they came for the slanderers and i said nothing."
Worse then that, because you probably didn't check for security issues and all the corner cases that other libraries developed over 2+ decades have dealt with.
No, I would take an approach similar to formal verification.
"First they came for the slanderers and i said nothing."
People reinvent the wheel all the time. You'd have to or else we'd still be using stone wheels. Even a bigmath library gets reinvented, I've seen many versions. That's because one size does not fit all and some of those libraries or their RAM usage will literally not fit on some machines.