Slashdot Mirror
How One Dev Broke Node and Thousands of Projects In 11 Lines of JavaScript (theregister.co.uk)
An anonymous reader quotes an article written by Chris Williams for The Register: Programmers were left staring at broken builds and failed installations on Tuesday after someone toppled the Jenga tower of JavaScript. A couple of hours ago, Azer Koculu unpublished more than 250 of his modules from NPM, which is a popular package manager used by JavaScript projects to install dependencies. Koculu yanked his source code because, we're told, one of the modules was called Kik and that apparently attracted the attention of lawyers representing the instant-messaging app of the same name. According to Koculu, Kik's briefs told him to take down the module, he refused, so the lawyers went to NPM's admins claiming brand infringement. When NPM took Kik away from the developer, he was furious and unpublished all of his NPM-managed modules. 'This situation made me realize that NPM is someone's private land where corporate is more powerful than the people, and I do open source because Power To The People,' Koculu blogged. Unfortunately, one of those dependencies was left-pad. It pads out the lefthand-side of strings with zeroes or spaces. And thousands of projects including Node and Babel relied on it. With left-pad removed from NPM, these applications and widely used bits of open-source infrastructure were unable to obtain the dependency, and thus fell over.
See this is the exact scenario I've talked about before, typically when learning a new coding language. Dependancies and libraries are BAD. 1: because they remove the need to understand what's actually going on (premade functions for example) 2: because some asshat could yank them away and leave your project broken, then YOU have to figure out how to replace the dependencies. I get not reinventing the wheel. But you really need to pay attention to what your code is dependent on and remove that dependency if possible
So, what have we learned?
External dependencies are unsustainable;
JavaScript is unmaintainable;
Dozens of mainstream projects relying on a trivial bit of string padding code from an external JavaScript dependency is unconscionable.
This is just hilarious. What a shit-show, from the bullshit legal threat to the developer's hissy fit to the dependence on an apparently obscure package to implement (lol) left-padding.
Reminds me of someone I knew who was wringing his hands for a few days over which license to use for his super-awesome R function library. He asked me for advice, and I told him that it's ~30 lines of syntactic boiler-plate code so get over yourself and just put it in public domain so that the two people who ever use it can do so easily. But of course, he had to deeply consider the political implications of which flavor of "freedom" he would support.
"They were pure niggers." – Noam Chomsky
Everything is one letter away of meaning something in some language.
Dependencies are unavoidable, specially on big projects - you are not expected to reinvent the wheel every time you code.
Now, having a dedicated library dependency for padding strings is a bit of a stretch though...
I've always thought this interconnected pile of stuff, linking across a bunch of domains was lazy, dangerous, and likely to be very brittle.
Sorry, but the interwebs have shown me I can't afford to trust arbitrary code from all over the place, which can change at a moments notice, and which I know nothing about.
If you've created an infrastructure where tons of stuff breaks because some asshole corporation forces some guy to say "fuck you, you can't have my code", you have a terrible mess. What happens if someone adds some malicious code?
What I find really odd is they've over-ruled him and said "no, you can't un-publish your own stuff, we own it". So, what, they've decided his stuff was too important to still be his own? So he got fucked because of corporate assholes only to have his copyright infringed?
Jenga tower indeed, it sounds like the state of the art is a bunch of brittle dependencies controlled by a few places, and subject to causing a shit top of things to happen when someone makes a change.
This reminds me of a company I worked at which had a universal build system ... everything build from scratch every day and wouldn't build if any of its dependencies didn't build. So when some guy broke a components 3 components upstream, nobody could get anything compiled because the system was too stupid to go with the last known good ... and hundreds of developers sat around all day going "but, what do you mean we can't do anything because some guy checked in shit code".
Wow, just wow.
Steaming Heaps of Innovative Technology.
Lost at C:>. Found at C.
So you say everybody should write their own buggy and incomplete reinvention of the wheel?
Yes, probably most of his libraries aren't longer than 2000 lines of code, and therefore are pretty replaceable, but I don't think that writing your own libraries will decrease the total number of bugs, it will rather increase them.
Bullshit.
Dependencies and libraries are fine. If you want to use SSL encryption in your software you should try and re-implement it all, because while SSL libraries have been having security issues in the last few years there's almost zero chance you make something that doesn't have bigger ones. Multiply that by all the domain specific pieces of code you need.
Not having to understand what's actually going on is a feature not a problem.
What is retarded is using a dependency that exists out in the internet somewhere only, so that your code breaks if some random internet service disappears. As long as you have your own copy of the dependency it's fine. Some asshat can't yank them away since you have your own copy that doesn't magically stop working. Obviously you want the source code, or at the very least the source code escrowed somewhere that you obtain if the provider vanishes in the future.
And the trademark for "KiK" an instant messenger "App" on phones or tablets, does not cover a "library" or even a "program" written for software development.
At least not in my country, and likely not in yours either.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
I don't think this proves libraries per-se are bad, but blindly depending on out-of-house software repositories for every build or (worse) every startup/deploy is crazy.
We're a Java house (go ahead, get your ki[c]ks in...), and we use around 100 open source libraries. They're all mirrored locally in an Ivy repository we maintain. No new versions get checked in unless they've passed a reasonable level of scrutiny, and nothing gets deleted unless we delete it.
It is 2016. You need to use libraries. You just copy them to your local repo so they are in a known state if you use them.
And your nick is one character away from including the word "reamer", and two letters away from being "screamer".
It is simply not possible to exclude every word which is one or two letters away from offending some random idiot who thinks being one letter away is the same thing.
People can give something a name which is totally innocuous to them and which someone else is going to get into a hissy fit about.
So, what's more likely, he had no idea some random guy on the interwebs would make the comparison to a racial slur, or he used a word which sounded cool to him?
Lost at C:>. Found at C.
Yeah, real programmer treat integers as byte arrays.
You kids and your new fangled pythons don't know how good ya'll have it.
Dependencies are unavoidable, true, but it's a good practice to vet libraries before you include them and make sure they're worth the risk.
The risk with Open Source libraries is usually long term maintenance - will the project be maintained for the lifetime of my project? If the project is not maintained, is it something you're willing to take on and will the license and community let you fork it? If not, there's risk.
You also have the risk we see here - ideology trumping pragmatism (that's a nice way of saying the developer had a fit and took his toys away for reasons even he doesn't fully understand). In those cases, you also have the chance to fork, assuming the license/community allows it.
For trivial operations, such as left padding, it's almost never worth the risk to use a library unless it's part of the language's standard library. Sure, don't write your own FFT or ORM, but if you can code a function in a few minutes for a well defined problem, there's no reason to add an external dependency.
-Chris
Nonsense. Laughable, even. Quality programmers can build anything. If they're wise, they will.
I guess you never worked with code then, eh? It is not about whether they can or cannot - is about the resources involved. Writing and testing a production-level software library is not a trivial task. It takes time.
Again, this does not apply to string padding, which is usually resolved on a couple lines of code on the language of your choice...
True, but lawyers don't understand those words, they just know it's about computers so anything computer related called "kik" must die. They are like marauding barbarians, waving their clubs in the air and smashing anything that looks a bit like the magic rock they worship.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
... I hope you're kidding. Don't reinvent the wheel - if someone else has already written the code then there's no reason to re-write it. That's a huge waste of man hours. Instead you should package all dependencies in such a way that they can be retrieved without requiring the other guy to still be offering it. Yes, that means a snapshot of the version you rely of should be in your repository because you also can't guarantee that a given version will be available as long as your own project is.
This is the USPTO we're talking about here. Instant messaging services and Node.js libraries probably both fall under a category like "Products and services pertaining to computers, electronic calculators, magnetic or paper tapes, teletypes, slide rules, and abacuses"...
0 1 - just my two bits
The AC is too busy to respond, he's currently fixing the 9999999 security flaws in his hand-rolled SSL library.
Thou shalt always mirror your dependencies. Never assume that everything will always be available. That's continuous integration 101.
Second paradigm: mirror even your dependencies source code, if you can.
Stupidity is the root of all evil.
Using other people's libraries is fine; you just need to keep your own copy of them instead of dynamically-linking (or hotlinking, in the case of Javascript web shit).
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Which only concatenates the string once.
It's fucking unbelievable how much trouble plumbing has caused for so many people.
Let's ignore how fundamentally broken it is, as a technology, in almost every respect. That includes its fucking awful historical association with toxic lead, its total lack of real modularity (sorry, reservoirs are complete shit), its ultra shitty set of mutually incompatible pipe sizes, materials, and connections (which is this problem exist in the first place), and similar problems.
Plumbing has allowed too many unskilled cranks to shit out way too many leaky pipes. It was one thing when they did it in Ancient Rome, where it was isolated to a fountain in the town square. Now it's being done in people's houses, and it's a motherfucking disaster!
Worse, plumbing has enabled the for-profit water supply industry. Plumbing makes it trivial for them to track every drop of water you use. If you don't want to fall victim to it, then you have to waste your time turning off a bunch of valves, and digging wells everywhere.
Plumbing needs to go.
If you really need to use a water delivery technology, use a river, or a pond, or even a goddamn barrel . All three of them are better than plumbing in every way.
I hope you're kidding. Don't reinvent the wheel - if someone else has already written the code then there's no reason to re-write it.
I hope you're kidding, and the present situation makes an excellent example of why.
Tracking down Open Source dependencies has become a complete nightmare, in many cases, because far, far too many devs unfortunately take your advice to heart. No, we shouldn't roll our own bigmath libraries, or nosql implementations. But what lazy-assed devs would import an external dependency for something as trivial as padding a string? Oh, right - Apparently thousands of them. Gee, I wonder why the business world doesn't take us seriously, despite offering them our work for the low, low price of "free"?
...and Docker is the new Solaris Zones. Err, okay?
The point isn't that node.js sucks (personal opinion - it kinda does when mishandled, just like PHP), it's that like any tool, you have to use it correctly and try not to make it do shit that it wasn't designed to do.
We see this shit in Puppet-land, where so-called DevOps people rely on external github (not puppetforge, but random github) modules to run their servers. They never pull a local copy, but instead use something like Librarian to pull it in dynamically... never realizing that if the guy maintaining $randomModule says 'fuck it' and pulls his project (or even just breaks his module), suddenly you're stuck with a broken model and a potential outage.
Quo usque tandem abutere, Nimbus, patientia nostra?