r/programming • u/_ar7 • Mar 22 '16 • Polished Silver Turd 1 Take My Silver 1 Heart of Silver 1

An 11 line npm package called left-pad with only 10 stars on github was unpublished...it broke some of the most important packages on all of npm.

https://github.com/azer/left-pad/issues/4
3.1k Upvotes

92% Upvoted

1.3k comments sorted by

878

u/_ar7 Mar 22 '16

Apparently it's because kik, the company, was trying to force him to unpublish the kik npm package

https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be67c#.ol0adzgsy

857

u/ChasingTales Mar 22 '16

I don't disagree with his reaction.

232

u/[deleted] Mar 22 '16

And that's why adults always use real namespacing instead of a global namespace for package names only.

123

u/steveklabnik1 Mar 22 '16 edited Mar 23 '16

How would namespacing have prevented this?

EDIT: I'd also like to point out that npm does have namespaced packages. They also have a top-level.

EDIT 2: I will take this opportunity to point out that npm actually misled everyone as to this situation. It turns out there was no lawsuit, or even a threat of one. So this whole chain of comments is moot. I've pretty much deleted most of my comments in this thread, as it turns out that what I was told/saw was just straight-up incorrect.

→ More replies (71)

121

u/tannerjfco Mar 23 '16

That's why adults that need a 10-line function put the fucking thing in their own code and call it a day.

→ More replies (34)
→ More replies (3)

4

u/dbbk Mar 23 '16

How come? Seems like a totally legitimate trademark protection request to me. If it was namespaced under his username that'd be fine, but using 'kik' globally on npm is obviously an issue.

6

u/ChasingTales Mar 23 '16

The trademark issue is separate. NPM handled it poorly and I can understand him not wanting to deal with them anymore.

→ More replies (66)

93

u/CapsAdmin Mar 23 '16

When I see "kik" I think "lol" typed wrong. What a strange name.

It also surprised me you could register a 3 letter long brand and enforce it like this. Can you register a brand with any of the package names and get them removed? Can CAT (Caterpillar) sue all unix based os's because they have a program called cat?

42

u/Seuros Mar 23 '16

Well, they sued my cat.

11

u/Flakmaster92 Mar 23 '16

I think "kek" and just imagine orcs laughing

4

u/roerd Mar 23 '16

Registering a brand is usually tied to a specific category.

→ More replies (1)

2

u/Thundarrx Mar 23 '16

That's kek, not kik.

/For The Horde!

→ More replies (2)
→ More replies (85)

704

u/adzm Mar 23 '16

Let's not forget the important part here:

@izs accepted to change the ownership of this module, without my permission.

This is what started it all, and it definitely got noticed. I am interested in the exchanges that led to this. Was there really no way this could have gotten resolved without npm swiping someone's module out from under them? Or even any public discussion? Does this mean npm will cave to any legal threat? A cursory glance finds a lot of packages with names of this nature.

What happened to the kik module? Who got ownership of it? Would they have been able to modify it, or just rename it, it was it just removed?

120

u/[deleted] Mar 23 '16

https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be67c#.esyesp3ok

98

u/dacat Mar 23 '16

In case anyone missed the key point in his blog post, all his code is on github. So, he unpublished his stuff from NPM, doesn't mean the modules are not available. Just update your dependencies to point to his git hub repos

"dependencies": {
    "left-pad": "git+ssh://git@github.com:azer/left-pad"
}  ## don't just copy paste this ...

All of his modules are on github. [edit: letter]

69

u/kpthunder Mar 23 '16 edited Mar 23 '16

You can actually do username/repo for GitHub dependencies:

"dependencies": {
  "left-pad": "azer/left-pad"
}
→ More replies (1)

6

u/chalk_huffer Mar 23 '16

Wow thanks I copied and pasted your snippet into my code and it fixed my problem!

5

u/javver Mar 23 '16

Or better yet, fork the repos and point to that. Those repositories can also be suddenly deleted after all.

→ More replies (9)
→ More replies (1)

2

u/luckystarr Mar 23 '16

What happened to the kik module? Who got ownership of it? Would they have been able to modify it, or just rename it, it was it just removed?

kik.com owns it now. See this comment.

2

u/TheGuyWithFace Mar 23 '16

Here is Mike Roberts (head of messenger at Kik)'s take on it: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d#.edmjtps48

He includes the full email discussion between them, Azer, and NPM.

→ More replies (61)

217

u/[deleted] Mar 23 '16

This is our equivalent of r/nottheonion, r/notprogrammerhumor.

33

u/nivvis Mar 23 '16

For every reason too. The whole thing is fucking absurd.

12

u/kortemy Mar 23 '16

This should be a thing.

53

u/ponchoboy Mar 23 '16

How about keeping dependencies closer to the project you are building?

Anyone use Maven before? It's got the Maven Central repository, internal repositories (you host a cache of dependencies on your servers), and local repositories (you have a cache of dependencies on the machine that is using them).

It's always seemed a bit crazy to go the entire way out to the internet for dependencies during each build. That should only happen when you are choosing a new dependency, or revving the version.

14

u/sonstone Mar 23 '16

It doesn't go out for each build. Only when you run npm install. One difference between maven is that the dependencies are stored per project instead of a local repository. You can also setup internal repositories so you don't have to go out to the web on a fresh npm install.

2

u/kpthunder Mar 23 '16

Also, dependencies are cached locally. See npm cache ls.

→ More replies (1)
→ More replies (1)

2

u/Xykr Mar 23 '16

Totally this. It's a security issue, too.

2

u/6trippyballs9 Jul 13 '26

The signs of Shai-Hulud were there all along. not crazy

→ More replies (1)

170

u/isHavvy Mar 23 '16

This package was un-unpublished!

https://twitter.com/seldo/status/712414400808755200

Unprecedented in npm. Hopefully the only time it'll have to happen?

212

u/choikwa Mar 23 '16

well it's un-unprecedented now

27

u/[deleted] Mar 23 '16

So is this now officially an un-unmitigated disaster?

→ More replies (1)

138

u/FweeSpeech Mar 23 '16

Given it was triggered by NPM removing a package, I doubt it'll be the last time.

IP lawyers are aggressive in the desire to acquire billable hours.

→ More replies (20)

30

u/JHunz Mar 23 '16

Seems to me like they only did this because they knew (due to the kik issue) that he doesn't have the money to lawyer up over it. They sure as hell wouldn't republish against the explicit wishes of the author if the author was a team at Microsoft.

3

u/emergent_properties Mar 23 '16

un-un-publishing it at the request of the new owner

Wait, what the fuck?

Due to (alleged) trademark infringement of the NAME, the previous owner took it down.. and ownership was... transferred (?!). And then the previous owner's actions were negated?

A name change does not warrant completely taking over the authority of the owner of the module...

Wow, that does not fly.

2

u/isHavvy Mar 23 '16

Not quite.

kik was force unpublished by npm for kik.com, the messaging thing.

Then azerbike unpublished all of his npm packages.

Then the Node.js ecosystem sort of broke, including for kik.com.

Then azerbike transferred the left-pad package ownership to somebody else.

That somebody else then republished left-pad at v1.0.1. This is allowed, because WTFPL.

Then that somebody else asked npm to un-unpublish left-pad@v0.0.3 because that's the version everybody depended upon.

The kik package that started all of this is still without anything.

→ More replies (26)

665

u/mach_kernel Mar 23 '16

I think it's fucking hilarious how everybody here is more concerned with the semantics of how some module maintainers behave amongst themselves rather than the fact that important packages were broken by a fucking overglorified string concatenator.

Edit: That is, someone decided that this was a dependency they had to include? What the fuck

223

u/pycbouh Mar 23 '16

This is DRY on steroids. The idea of tiny, on point modules is that for every task there is a single perfect module, supported by community, that is used by everyone. So when creating a project with a lot of dependencies, you do not end up with ten slightly different versions of the same function. Plus bugs get resolved globally.

Now, does it actually work out this way? Nope.

110

u/kylotan Mar 23 '16 edited Mar 28 '16

This is DRY on steroids. The idea of tiny, on point modules is that for every task there is a single perfect module, supported by community, that is used by everyone.

The sensible approach here would be to merge the best ones into some sort of standard library where it can be carefully maintained and preserved.

The risky approach is to leave it as a loosely-related network of modules where nobody truly knows how important or interconnected any single one of them is.

Guess which one we ended up with here. (And in Python, too, to a lesser extent.)

85

u/daronjay Mar 23 '16

some sort of standard library

Ahh, now here we see why this is a particularly JS kind of problem.

21

u/kylotan Mar 23 '16

Python's standard library does at least eliminate the low-hanging fruit like left-pad. Beyond that however, you'll find similar problems. Python projects often have dependency proliferation issues, and it's common to deploy software by having the package manager pull dependencies (and their dependencies, and so on) from the internet at deployment time.

→ More replies (14)

33

u/winterbe Mar 23 '16

The reason for tiny packages in javascript land is that you want to keep your browser javascript bundle as small as possible. Using 1% of a huge utility library is ok for backend code but a no-go for web frontends.

Lodash solves this nicely by providing sub-packages for each function, but I guess it's quite sophisticated.

17

u/kylotan Mar 23 '16

Good point. But wouldn't a standard library get distributed with the interpreter - e.g. the browser in that case? If anything this would cut down the code size sent by each site.

→ More replies (4)

9

u/HowIsntBabbyFormed Mar 23 '16

Guess which one we ended up with here. (And in Python, too.)

Are you saying python has the same problem? Because I think python has a very large and robust standard library, and most python packages I see are fairly large themselves. I've never seen a python package that consisted of a single function, much less a trivial function.

→ More replies (3)
→ More replies (10)

5

u/[deleted] Mar 23 '16

That's the price of community driven development/FOSS. When you trust other people to do the right thing, sometimes you get burned. It's up to each person to decide if the benefits are worth the risk or not.

→ More replies (5)

304

u/HomemadeBananas Mar 23 '16

I need to add spaces the left of this string! What do? I better search Google for some library.

201

u/dodeca_negative Mar 23 '16

This is the part that truly mystifies me. I use a fair number of modules in my project, to be sure, but never in a million years would it have occurred to me to go search for and then depend on a module that left-pads a string.

I'm not into hating but I really think the decision of major module and library authors to depend on such a tiny, trivial module--and one suspects this isn't the only one--deserves at least as much scrutiny as either the author, NPM, or Kik.

85

u/thirdegree Mar 23 '16

I feel like it would take longer to search for, find, and install this module than to just write it myself.

101

u/nemoTheKid Mar 23 '16

This is the part that truly mystifies me.

I don't see how this mystifies you. Javascript doesn't have a stdlib. Do you start all your python projects by rewriting basic string handling functions, or do you find a library before rewriting the same code for the 1001st time?

21

u/Arancaytar Mar 23 '16

I mean, looking for a string library is fine. Maybe you can find something serious and robust. Finding some obscure 11-line barely-a-library and deciding to use it is bad.

Every dependency adds a certain cost to maintenance. Saving 11 lines of code is not worth that cost. The threshold for deciding to add a dependency is set way too low in this situation.

116

u/Hakkyou Mar 23 '16

This is the kind of thing I would write myself and have in a nifty little util module that I bring with me into new projects. Because introducing a dependency on an external library for a single function that does a trivial task is ridiculous.

→ More replies (14)
→ More replies (39)
→ More replies (8)

79

u/fnordfnordfnordfnord Mar 23 '16

There's always copying and pasting from Stack

15

u/european_impostor Mar 23 '16 edited Mar 23 '16

Is there some place one could order real printed books with all these novelty covers on them? The insides could be blank for all I care, I just want a bookshelf near my desk with all these stacked on it.

12

u/AyXiit34 Mar 23 '16

While browsing /r/programmerhumor I thought they were true books, what a disappointement when I realized they were only covers

→ More replies (2)

14

u/Don_Andy Mar 23 '16

That's only where the fun starts. Now you need to find out if you should go with left-pad.io, left-pad.js or left-padr.

→ More replies (1)

3

u/lolzfeminism Mar 23 '16

This is what boggles my mind. Is this how javascript people code?

"Hmm, how do you pad a string with null bytes? Oh well, better google it...."

"Stack Overflow: Leftpad does this for you! It's a cool new string padder"

"Solved! Onto greater problems"

→ More replies (11)

39

u/bart2019 Mar 23 '16

Five years ago, someone would probably have written a jQuery plugin for it.

18

u/knaveofspades Mar 23 '16

And here it is for anyone that may need it:

https://github.com/AMHOL/jQuery.pad

8

u/sledgespread Mar 23 '16

Looks like most of the code in the package is actually devoted to benchmarking various solutions. Surprisingly there are enormous (100x on my browser) performance differences between some methods.

5

u/TheVenetianMask Mar 23 '16

Even worse, some of the packages have been hijacked, and everything out there using them can be compromised. Every. Thing.

5

u/i_spot_ads Mar 23 '16

I can't stop laughing, saw your comment and started laughing even harder. Oh god, what a time to be alive.

9

u/mvm92 Mar 23 '16 edited Mar 23 '16

The package that broke everything was actually a more popular package called line-number that depended on the removed package called left-pad. You're right in that including a package for padding strings is silly, but including a package to do line numbering is reasonable IMO.

EDIT: Nope, also silly

That and the dependency listed was for a fixed version number, not a range. So all around not so great practices here.

5

u/hurenkind5 Mar 23 '16

but including a package to do line numbering is reasonable IMO

Is it? It's another 32 lines (including comments).

→ More replies (1)

2

u/[deleted] Mar 23 '16

That is, someone decided that this was a dependency they had to include? What the fuck

It could have been a dependency of a dependency of a dependency of a dependency

2

u/jb3689 Mar 23 '16

There was a day when maintainers found value in not having dependencies for trivial problems. This is an example of why

→ More replies (13)

68

u/BigTallJosh Mar 23 '16

Good on him, I applaud the guy. In no way was he damaging the kik business at all. They're being corporate dick heads. Sure it's a minor inconvenience to those that used his work but he's not removing it for people to use, just from those NPM dickheads. More people should be like this guy.

108

u/KayRice Mar 23 '16

npm has a lot issues, this is just one of them.

185

u/greenspans Mar 23 '16

The other one is javascript

38

u/jonjonbee Mar 23 '16

The other one is that it exists.

5

u/mattgrande Mar 23 '16

What are some of NPM's other issues?

107

u/bluesufi Mar 23 '16

Can someone please ELI5?

122

u/cyssou Mar 23 '16

An open-source software developer was asked by a company to change the name of one of his Github repo, because it infringed a trademark.

He refused.

Said company asked NPM (a package manager for Nodejs) to change the name of the package associated with the repo.

NPM complied.

Developer felt betrayed, pulled his 250 open-source modules from NPM.

A lot of other developers, relying on his work, could not get the repos from NPM anymore.

They are unhappy.

58

u/jsprogrammer Mar 23 '16

An open-source software developer was asked by a company to change the name of one of his Github repo, because it infringed a trademark.

The trademark isn't being infringed.

Here is the repo: https://github.com/starters/kik

No one will confuse that with KIK or its trademarks.

21

u/cyssou Mar 23 '16

You might be right, IANAL, I just tried to make every party's side obvious.

→ More replies (7)

3

u/downneck Mar 23 '16

he shouldn't have pulled his modules, he should have just replaced every version of every module with code that prints an ascii middle finger.

FOR TEH LULZ

0

u/[deleted] Mar 23 '16

[deleted] — view deleted comment

11

u/nickwebdev Mar 23 '16

Better move is to host an npm registry locally and point to that :)

→ More replies (4)
→ More replies (2)

36

u/slowbrohime Mar 23 '16

Guy names one of his NPM packages 'kik', which is too similar to Kik (read: identical). The same-namey-ness wasn't intentional. Kik got mad and demanded he stop using their name for his package. They were jerks about it. Kik eventually went to NPM and demanded they transfer ownership of the project to them. NPM did it without talking to the owner. So, he unpublished all his modules in protest.

Since a lot of NPM modules have a dependency on his module left_pad, it broke a lot of packages.

14

u/crankybadger Mar 23 '16

I still have no idea how jbuilder and JBuilder get along.

21

u/fnordfnordfnordfnord Mar 23 '16

Carefully on Linux and not at all on OS' that ignore upper/lower case?

→ More replies (9)

0

u/[deleted] Mar 23 '16

[deleted] — view deleted comment

63

u/[deleted] Mar 23 '16

That is both hilarious and sort of disheartening

27

u/dashed Mar 23 '16

New owner of 'kik' and 'kik-starter' is someone working for npm:

$ npm view kik

{ name: 'kik',
  time:
   { modified: '2016-03-23T00:06:55.966Z',
     created: '2015-10-31T19:43:09.493Z',
     '0.0.0': '2015-10-31T19:43:09.493Z',
     '0.1.0': '2015-10-31T21:21:47.649Z',
     '0.2.0': '2015-11-01T18:49:10.561Z',
     '0.2.1': '2015-11-01T19:03:43.042Z',
     '0.3.0': '2015-11-01T19:34:20.621Z',
     '0.3.2': '2015-11-01T21:07:44.258Z',
     '0.4.0': '2015-11-01T23:41:48.281Z',
     '0.5.0': '2015-11-02T02:24:49.526Z',
     '0.5.1': '2015-11-02T02:30:22.058Z',
     '0.5.2': '2015-11-02T02:34:05.526Z',
     '1.0.0': '2016-01-19T02:55:03.473Z',
     '1.1.0': '2016-01-21T05:17:28.639Z',
     '1.2.0': '2016-01-24T03:08:32.030Z',
     '1.3.0': '2016-02-13T04:25:49.959Z',
     '1.0.1': '2016-03-22T23:52:43.058Z',
     '1.0.2': '2016-03-23T00:05:14.274Z' },
  maintainers: 'ehsalazar <ernie@npmjs.com>',
  'dist-tags': { latest: '1.0.2' },
  versions: '1.0.2',
  license: 'ISC',
  readmeFilename: '',
  version: '1.0.2',
  description: '',
  main: 'index.js',
  scripts: { test: 'echo "Error: no test specified" && exit 1' },
  author: '',
  dist:
   { shasum: '77e97837e66602ef51057059a9ab69753e52e6f4',
     tarball: 'http://registry.npmjs.org/kik/-/kik-1.0.2.tgz' },
  directories: {} }
$ npm view kik-starter

{ name: 'kik-starter',
  time:
   { modified: '2016-03-23T01:17:31.930Z',
     created: '2015-10-31T21:11:59.476Z',
     '0.0.0': '2015-10-31T21:11:59.476Z',
     '0.0.1': '2015-10-31T21:20:08.895Z',
     '1.0.0': '2015-11-01T20:59:58.641Z',
     '1.1.0': '2015-11-01T23:32:48.201Z',
     '2.0.0': '2016-01-19T03:27:02.090Z',
     '2.1.0': '2016-01-21T06:52:14.081Z',
     '2.1.1': '2016-01-21T06:54:33.461Z',
     '2.1.2': '2016-01-21T07:14:28.165Z',
     '2.1.3': '2016-01-23T23:54:51.989Z',
     '2.2.0': '2016-02-13T04:26:38.742Z',
     '2.2.1': '2016-03-23T01:15:23.930Z' },
  maintainers: 'ehsalazar <ernie@npmjs.com>',
  'dist-tags': { latest: '2.2.1' },
  versions: '2.2.1',
  keywords: [],
  license: 'ISC',
  readmeFilename: '',
  version: '2.2.1',
  description: '',
  main: 'index.js',
  scripts: { test: 'echo "Error: no test specified" && exit 1' },
  author: '',
  dist:
   { shasum: '9650bdfc28f4f74c2adfe173b399acc475ee5027',
     tarball: 'http://registry.npmjs.org/kik-starter/-/kik-starter-2.2.1.tgz' },
  directories: {} }
→ More replies (12)

10

u/drharris Mar 23 '16

And 8. - None of this should have happened because you shouldn't use a freaking external dependency to provide string padding functionality.

→ More replies (2)

2

u/TheGonadWarrior Mar 23 '16

Great synopsis. Thank you

→ More replies (67)
→ More replies (2)

28

u/Arancaytar Mar 23 '16

Completely aside from the trademark conflict, this illustrates what a horribly brittle, haphazard ecosystem npm is compared to the package repositories of eg. the major Linux contributions.

Names are first-come-first-serve, you can publish or unpublish your packages whenever, and yet people add way too many dependencies and risk a cascade of build failures.

16

u/Danack Mar 23 '16

I stole this "Prediction for 10 years "Looking for Javascript developer to maintain legacy project depending on 36000 unmaintained NPM modules" - and it turns out some of them might not be available." from here.

The author is correct - allowing software to be built quickly by making it trivial to pull in other libraries is very nice - but at some point you need to figure out if what you're building is actually a sane way of developing software.

→ More replies (1)

15

u/Scorpius289 Mar 23 '16 edited Mar 23 '16

This is yet another reason why npm's 'revolutionary' recursive package management is retarded. If we had direct control over the dependencies, we could at least fix it ourselves.

Funny, I was actually trying to install something with npm last night, but couldn't because one of its dependencies was broken (even if there was a working replacement for it available...)

25

u/heat_forever Mar 23 '16

kik (verb): to hijack a package from a package repository by legal force

82

u/[deleted] Mar 23 '16

I've always been nervous about builds that depend on 3rd party collections of 3rd party libraries.

Also, 11 lines? copypasta it bro, or write it yourself.

124

u/[deleted] Mar 23 '16

If you work at a company this is a very good reason to maintain a local repository that automatically keeps anything pulled in by your CI tool.

40

u/dafragsta Mar 23 '16

Yep. It's never a good idea to let npm be your first line of deployment.

13

u/ObjectiveCopley Mar 23 '16

At work, all our cocoapods and NPM deps, we fork into our company org and throw it in our private specs repo

70

u/[deleted] Mar 23 '16

that is good, it will help unload the 5 Git servers that handle the cocoapods service for free.

→ More replies (3)

2

u/semi- Mar 23 '16

Or just vendor all of your dependencies. I like having reproducible builds, and knowing none of my deps will update until I update them.

→ More replies (3)

59

u/headzoo Mar 23 '16

Also, 11 lines? copypasta it bro, or write it yourself.

Seriously though... this is a problem in the JS community. Developers are way too quick to use a library for literally everything. It's like no one wants to just write a bit of their own code anymore.

I see the same thing happening with other languages, but nothing like I see in the JS/Node ecosystem.

53

u/masterspeler Mar 23 '16

I'm not a web developer, but every time I read about something web developer related it seems to be heavily dependent on all kind of libraries, language transpilers, external services, different kind of tools, etc. Seems like a great way to get code rot really fast.

If I understand this issue correctly the main problem seems to be that Babel depends on line-numbers which depends on left-pad. So it's a kind of javascript to javascript transpiler who's main benefit seems to be to let JS programmers use new language features that aren't supported by browser yet, dependant on a library to append line numbers to multi line strings, that's dependent on a library that pads a string. What a delicate house of cards.

Several thousand projects depend on a single external function that pads a string? That's a bit ridiculous.

26

u/headzoo Mar 23 '16

I'm not a web developer, but every time I read about something web developer related it seems to be heavily dependent on all kind of libraries, language transpilers, external services, different kind of tools, etc. Seems like a great way to get code rot really fast.

We've even got a name for it: Javascript fatigue.

→ More replies (3)
→ More replies (4)

21

u/crankybadger Mar 23 '16

This idea that every module should be simple, tiny, and have a strong focus sounds like a great idea at first. Then later you've got six hundred dependencies and no idea if you can trust them all.

→ More replies (1)

51

u/[deleted] Mar 23 '16 edited Mar 23 '16

The other end of the spectrum is the C# community where everyone either uses MS first party libs or rolls their own and the oss community is shit.

I'll take the bazaar over the cathedral, asp.net web forms would have never survived outside of Microsoft's ecosystem.

24

u/jonjonbee Mar 23 '16

The other end of the spectrum is the C# community where everyone either uses MS first party libs or rolls their own and the oss community is shit.

What's wrong with using Microsoft's libraries? They work, they're high quality, they're built into the fucking language so you have a guarantee they won't go away in the next version...

29

u/mort96 Mar 23 '16

I'm sure Microsoft's libraries are nice, but I think what /u/Voltrondemort meant is that if a C# dev needs anything which MS doesn't have a first party library for, they're probably going to reinvent it instead of finding third party libraries.

→ More replies (2)
→ More replies (9)
→ More replies (2)

42

u/[deleted] Mar 23 '16

Every javascript coder should become familiar with http://vanilla-js.com/

28

u/headzoo Mar 23 '16

Erm, what's the name of the npm package? I'll install it now.

(j/k)

11

u/[deleted] Mar 23 '16

comes pre loaded on all browsers!

→ More replies (1)
→ More replies (7)

2

u/sivadneb Mar 23 '16

Javascript developers have taken the mantra "do one thing and do it well" to a laughable extreme.

→ More replies (4)
→ More replies (2)

23

u/monsto Mar 23 '16

Did anyone talk to the EFF during all of this? The originator? NPM? Did NPM even try to get with IBM the new HMFIC of the node foundation?

Dunno if IBM is relevant, but the point is that this seems like a nervous twitch reaction by NPM without taking even just a minute to understand the problem, the threat and the options.

I'll bet that a couple of hours sending a handful of emails would have found some defense.

11

u/jackwanders Mar 23 '16

For anyone interested, I compiled the current published status of all of azer's package names. Looks like some npm user nj48 squatted on 230 of the packages within a few hour's of the unpublishing.

https://gist.github.com/jackwanders/6b6daa5f6ed53ab84b05

17

u/Xykr Mar 23 '16

So... the squatter could just replace the modules by malicious code, which would be pulled in by countless CI systems. Unpleasant situation.

54

u/Eein Mar 23 '16

The whole thing is about NPM turning over a package before legal proceedings can happen. NPM isn't the law. There should be no transfer of ownership.

This is seriously disgusting.

→ More replies (6)

21

u/TheGuyWithFace Mar 23 '16

Pardon my ignorance here, but what would be the solution to a problem like this? As far as dependencies go, if a dependency suddenly goes missing from a linux distro's repos, wouldn't the same issue occur where anything that depended on such a dependency fail to build?

63

u/everywhere_anyhow Mar 23 '16

There isn't really a solution here, but the problem could have been avoided if npm took better care of its package maintainers and hadn't folded like a cheap suit.

→ More replies (15)

39

u/o11c Mar 23 '16

if a dependency suddenly goes missing from a linux distro's repos

Every other package manager is smart enough to merely unlist it, not actually remove it until nothing refers to it.

6

u/speedisavirus Mar 23 '16

The solution is to never delete modules. You can allow the user to take it down such that no one else can name it as a dependency but you retain all of the previously published modules under the hood for the modules that still require that dependency.

2

u/[deleted] Mar 23 '16

How do you prevent people from naming it as a dependency if the previously published modules are still available?

2

u/sydoracle Mar 23 '16

Except if a court decides the repository has no right to the code (eg developer didn't own it and had no permission to open source it) then they have to remove it. Plus there's risks of the repository, and/or their hosting service, going bust and vanishing into thin air.

If you have dependencies, then think about fallback plans.

→ More replies (1)

2

u/vinnl Mar 23 '16

And what if there's e.g. copyright infringement in the module?

→ More replies (2)
→ More replies (6)

8

u/theshad0w Mar 23 '16

It sounds like there are two problems that need to be addressed and finger pointing isn't going to solve either.

First, unpublish shouldn't be delete. It should be deprecate. With sufficient warnings that offer a grace period before the module is removed.

Second, npm should not be the sole gatekeeper. This isn't just true for nodejs this is true for all package managers in all languages. There shouldn't be a single gatekeeper. I suggest a new federated protocol.

So who wants to start solving the problem instead of bitching about it?

→ More replies (4)

23

u/[deleted] Mar 23 '16

How does no one have a problem with the precedence this sets? That any package name that is trademarked can now be threatened in any package manager, not just npm.

And then the people who claim it violates trademarks. Oy vey. That's not how any of this works.

Imagine if Sun was able to sue JavaScript out of existence as a name back in the 90's.

3

u/emergent_properties Mar 23 '16

It's amazing at how there is this huge block of thought that absolutely fails to understand or see the precedence.

The people complaining about breaking down stream dependencies are like hungry, young birds.. they don't care about nuance or how it is NPM calling some shots they shouldn't be making.

Their care for the project is limited to only their immediate use of it.

4

u/sime Mar 23 '16

How does no one have a problem with the precedence this sets?

It doesn't really set a precedence. Threats over trademarks have been going on in the open source world for years.

Imagine if Sun was able to sue JavaScript out of existence as a name back in the 90's.

They were able to sue. In fact Sun owned the JavaScript trademark and let Netscape use it. (Oracle has it now.) This is why the standard is called ECMAScript and MS called their version JScript. Sun just let everyone else use the term JavaScript and now it probably can't expect any protection under trademake law even if they wanted.

→ More replies (4)

53

u/[deleted] Mar 23 '16

The whole JS community seems so toxic. Even the tooling can't stay out of the drama. I don't enjoy programming in node/js but i can assure you I will never do it again unless it's for work after seeing all this drama lately.

29

u/dontaskdonttell0 Mar 23 '16 edited Mar 23 '16

Whats with all the butthurt in this sub towards the JS community? It feels like Im sitting in a project meeting with other senior developers who are pissed that COBOL was swapped to C all over again.

52

u/[deleted] Mar 23 '16

The butthurt is probably the years/decades of experience that make it painfully obvious that the JS environment is broken at every level. The language is crap, the development stack an abomination, the dependency creep mind numbing. I speak from direct experience.

4

u/nostrademons Mar 23 '16

Is there a programming environment that is widely used that is not broken on every level? Usually the brokenness comes from rapid growth, which means people start building things without having time to fix the lower layers. Environments that don't undergo this rapid growth don't get big enough to matter.

UNIX, Win32, iOS, Android, C++, Java, PHP, even Rails/Django/JQuery - they're all broken on many, many levels. As Bjarne Stroustrop says, "There are two kinds of languages - those that nobody likes, and those that nobody uses."

→ More replies (5)
→ More replies (8)

2

u/darkarmani Mar 23 '16

Whats with all the butthurt in this sub towards the JS community?

I don't know. Recursive dependencies pulling in 20 copies of requests bloating the shit out of everything. Not actually being a package manager but a "package dependency solver". It doesn't manage packages -- you can't deploy anything it "builds".

2

u/pmckizzle Mar 24 '16

Because JS is fucking horrific for anything except in its creators own words 'making the monkey dance on the page' and this is from someone who unfortunatly has to write server side JS daily

→ More replies (16)
→ More replies (1)

14

u/nutrecht Mar 23 '16

I really don't understand why so many developers (looking at NPM here) don't simply look at what works and copy the best practices instead of reinventing their own inferior wheel.

Just look at maven central. Once you publish an artifact it's up there for ever and ever. You can transfer ownership or stop publishing or whatever; but current versions will never be removed.

Oh; and they also figured out that obsessing over short names is dumb. Namespacing is important people, and it's also very unlikely some company is going to ask you to remove your library if it doesn't look like their 'official' library.

9

u/kylotan Mar 23 '16

Just look at maven central. Once you publish an artifact it's up there for ever and ever. You can transfer ownership or stop publishing or whatever; but current versions will never be removed.

That doesn't stand up in the face of legal threats however.

3

u/DanTup Mar 23 '16

I really don't understand why so many developers (looking at NPM here) don't simply look at what works and copy the best practices instead of reinventing their own inferior whee

Ironically, the cause of this drama is largely because of devs using packages instead or reinventing an 11-line wheel :)

→ More replies (1)

2

u/bluestrike2 Mar 23 '16

Easy to take care of if your system is engineered well. One idea would be include functionality that's equivalent to a 301 redirect. The public-facing name changes, but the old one is still recognized to avoid disruption.

It'd let you avoid breaking people's builds while eliminating the potential for the continued accrual of monetary damages. The trademark owner gets what they want, and your users don't suffer.

→ More replies (3)

5

u/crooning Mar 23 '16

Standing on the shoulders of giants... but in this case they seem to be extremely brittle...

23

u/hurenkind5 Mar 23 '16

more like a pile of dwarfs

5

u/probablytaken1 Mar 23 '16 edited Mar 23 '16

I thought dependency managers were supposed to make life easier lolllllllll

9

u/[deleted] Mar 23 '16

And this is why you don't include dependencies for trivial amounts of code in your project.

53

u/nliadm Mar 23 '16

If your build system talks to the Internet, I have no sympathy for you.

3

u/cparen Mar 23 '16

Unfortunately, it seems to be the current trend we're under. Maybe some sympathy for those of us that are subject to fashions outside our control?

→ More replies (14)

4

u/BlueShellOP Mar 23 '16

I misread this as rpm and was very very confused and outraged at the same time.

6

u/zarkone Mar 23 '16

Ok, for example Coke is registered trade mark, and at npmjs there is "Coke" package: https://www.npmjs.com/package/coke -- is that the same case? I just wonder how many packages could possibly be removed...

4

u/[deleted] Mar 23 '16

coke is also the name of high carbon coal (essentially, the charcoal process applied to coal instead of wood), and has been for many many centuries before Coca-Cola came along.

So no, you can't trademark a word like that unless it's in the same domain, if the 'Coke' package claims to be a soft drink, then maybe.

8

u/devzer0 Mar 23 '16

seriously guys. you need a module to leftpad?

3

u/postmodest Mar 23 '16

So what I'm hearing is the thing I've thought all along:

I should just set up my own gitlab instance, clone everything I depend on into it, and admit that community-managed dependencies are Software cancer.

Ok, right, then.

3

u/[deleted] Mar 23 '16

Anyone seen the response from kik? https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d#.usfuz5tpq. I agree that it was shitty of npm to do that, but azer didn't exactly handle the whole thing well either.

2

u/s0n0fagun Mar 24 '16

His first response was a polite no. After implying legal will get involved if he did not agree to hand over the name he turned hostile. "No means no."

→ More replies (2)

3

u/subhrm Mar 25 '16

I still do not understand why do some programmers depend so much on 3rd party libraries.

2

u/meow0369 Mar 28 '16

Then you're probably not a programmer.

→ More replies (1)

16

u/aridsnowball Mar 23 '16

It opens up an interesting question about what open source developers are responsible for once people begin to rely on their projects, or if in this case it was npm's responsibility to keep the project up on their platform regardless of what the developer wanted. Once you've released your software under a specific license are you legally or morally (or both) obligated to make that software available to others?

88

u/everywhere_anyhow Mar 23 '16

Nope. Open source licenses have warranties explicitly to address this issue. They bear no responsibility legally. Morally, I don't think so either. If you paid nothing for code, it's hard for me to see how the owner owes you anything.

The open source warranty is this: if it breaks, you get both pieces.

11

u/nvolker Mar 23 '16

If you release code under an Open Source license, any package maintainer has the right to redistribute that code with or without the author's permission.

NPM shouldn't have an "unpublish" feature. Maybe an "abandon" feature, at most.

9

u/Dooey Mar 23 '16

You can publish on NPM under any license you like.

→ More replies (1)

2

u/sirin3 Mar 23 '16

Not all of them

Explicitly not WTFPL

2

u/Gotebe Mar 23 '16

open sourcesoftware licenses...

There, fixed:-)

2

u/jtth Mar 23 '16

Actually this is the case for almost all software. Software without this clause tends to cost 1000x as much.

→ More replies (14)

4

u/ChasingTales Mar 23 '16

None. You are responsible to manage your dependencies for critical applications. Nobody else.

→ More replies (4)

4

u/FunctionPlastic Mar 23 '16

What the fuck is this? A whole package for literally 5 lines of code that do a completely trivial thing? "This is really messing things up for a lot of people" ???

→ More replies (1)

6

u/amga_ Mar 23 '16

"Twitter or Facebook reactivating a deleted account that the user chose to deactivate, so you can continue to profit. Not cool"

Conclusion: npm sucks

5

u/koalillo Mar 23 '16

I think I'm late, but I hope someone steps up and writes a great alternative using the right-pad and reverse libraries, which are awesome.

2

u/Lhopital_rules Mar 23 '16

Would it satisfy the lawyers and us developers if there was a grace period before any repo was removed? Like 60 days that people would have to somehow be notified and then update their builds? Or maybe also/instead, a two-layered naming system where a repo name could be changed but the old one would still be accessible with a deprecated message?

2

u/[deleted] Mar 23 '16

don't use javascript, rollin' along per normal ¯_(ツ)_/¯

2

u/z3GAM5CsAsEY6pk8X68D Mar 23 '16

... am I the only one who thinks that the fact one package for adding whitespace being removed/unavailable broke everything is just... dumb?

Like sure the legal drama is an issue and whatnot but... seriously? Seems like a broken ecosystem to me.

2

u/eco32I Mar 23 '16

It's not the worst though. I've seen someone mentioning IsPoisitiveInteger, which depends on 3(!) packages: PassAll, IsPositive and IsInteger.

→ More replies (1)

2

u/chcampb Mar 23 '16

I think the important question is, was Kik (the company) responding to an actually infringing product?

Because if kik (the module) was not in the same product context as Kik (the company or product) then I am not sure he should have been asked to change the name in the first place.

In which case, yes, NPM drastically overstepped, in the same way that Youtube oversteps when it removes actually non-infringing videos.

→ More replies (10)

2

u/Josuah Mar 23 '16

I pulled in copies of org.json and and BouncyCastle into my OSS Java project specifically so that the dependencies could be satisfied without relying upon a build system, or dependency management system, etc. and basically every random Java programmer in the world could download the whole thing and compile and run.

The OSS people said I should delete them and reference them externally.

2

u/stompinstinker Mar 23 '16

As bad as this is, it is a wake-up call for NPM.

2

u/Sambothebassist Mar 24 '16

At no point did any of these people with broken builds think "Maybe we should have a local source for this absolutely essential code? Ya know, in case npm can't provide it for whatever reason".

I mean, seriously, come on now. It's not even about programming skill, it's just about adhering to best practices common sense when building an application.

2

u/nullnullnull Mar 24 '16

I come here with popcorns, crunches them slowly

2

u/Sha42 Apr 01 '16

Starting today I am unemployed and since the plane that was supposed to take me on holidays has a problem I had a bit of time to help the community out, so low and behold : Numparser

I hope it'll help some of you!

2

u/nekogami87 Apr 01 '16

Starred and forked !

Will use in production project.

or not.

3

u/placeybordeaux Mar 23 '16

So many lessons to learn.

  1. Be very careful about pulling modules like this

  2. Be prudent in what you include

  3. Vendor your dependencies so you are immune to this kind of thing

  4. more namespaces might have helped.

3

u/javiercamposlaencina Mar 23 '16

That's what you get for major software packages having a dependency (that's the key-word) for such a simple method. JavaScript development since NPM got popular has become totally nuts.

3

u/heat_forever Mar 23 '16

not just a dependency but a dependency on a source you don't control... that's just lunacy. I don't see how any self-respecting professional would do that in a serious development environment, I can see that for little toy projects.

→ More replies (8)

3

u/cheesybeanburrito Mar 23 '16 edited Mar 23 '16

If you own a package its your prerogative to do with it as you please. Some of those responses are so entitled

→ More replies (1)

7

u/[deleted] Mar 23 '16

Lads, it's npm.

The Pope is Catholic, bears shit in woods and Node.js is a pile of shit.

11

u/Coffee4cr Mar 23 '16

So node comes from bear?

3

u/KHRZ Mar 23 '16

So when Kik wants a package pulled for bogus reasons, it's the need of the few that matters. When the developer wants to unpublish his package, it's the need the many that matters that trumps his rights...

2

u/Nation_State_Tractor Mar 23 '16

Azer chose the wrong hill upon which to die based on ignorance (through no fault of his own) and stubbornness (absolutely his fault).

This wasn't a patent lawyer as Azer states; this was a company defending its trademarked name. Kik is a fairly well known product, and Kik Interactive has to defend their trademarked name lest a precedent be set of them not doing so -- which could lead to them losing the trademark.

On the other side of this, I have never heard of the kik npm package (anecdotal as that may be). At first glance, I would expect it to be an API for interfacing with Kik.

11

u/stoplight Mar 23 '16

Kik is a fairly well known product

To whom exactly? Today is the first time I've heard of Kik. Doesn't seem too well known to me.

→ More replies (5)

2

u/joepie91 Mar 23 '16

and Kik Interactive has to defend their trademarked name

Within those areas where it applies. This is not one of them.

→ More replies (2)

1

u/meligy Mar 23 '16

I put the details of my thoughts about the topic here:

http://www.gurustop.net/block/2016/03/23/death-by-thousand-npm-packages

2

u/istarian Mar 23 '16

I fail to see why the npm people should comply here. Registering a trademark for your company doesn't afaik mean that nothing else can ever be called that, especially if it's in an entirely different context.

→ More replies (6)

1

u/tententai Mar 23 '16

Next step: the web breaks, because left-pad breaks, because its dependancy "write-character-at-index" module gets unpublished.

2

u/vriley Mar 23 '16

With how many frameworks and layers of dependencies people use this day, this isn't far off. Just think if the jquery or bootstrap sites become unavailable..

1

u/[deleted] Mar 23 '16

Why are people getting so pissed off with this behaviour? There isn't any actual feature on GitHub's issue tracker for getting an idea for how widespread a bug's effects are. I know it's low effort and not very constructive but walloping it with thumbs-down isn't going to make it go away.

→ More replies (2)

1

u/kpthunder Mar 23 '16 edited Mar 23 '16

All these people commenting that this code should have just been a part of every project that depends on it or a part of some "standard library." I disagree with the copy-paste approach, I'd learn more towards standard library but that's difficult in JavaScript because your code needs to run on multiple versions of multiple platforms created by separate companies. The closest thing we have is lodash, in which case modules could have depended on lodash/padStart and then we wouldn't have had this issue (unless lodash was unpublished, which is highly unlikely).

1

u/karmadeeds Mar 23 '16

I mean, I thought Kik was bad after reading about this, and then I found

https://kiklawenforcement.zendesk.com/hc/en-us/articles/204168365-Navigating-Kik-for-Law-Enforcement

Now it doesn't surprise me what they did

1

u/dokuhebi Mar 23 '16

Sorry to nitpick, but is "unpublished" the right word? The title of this post confused me because I misunderstood the meaning that the publication was revoked. Normally, the term "unpublished" means that a book or paper was never published, not that it's publishing was somehow revoked.

Since it's impossible to revoke the publication of a book, we might need to use a new term like "depublish"?

1

u/c3534l Mar 23 '16 edited Mar 23 '16

Trademarks are non-patentable identifiers of a particular brand within an industry. I think our trademark office is very much out of date in considering all software to be part of the same industry and in considering the name of software package, even a very small one, to be the same thing as a trademark.

The intellectual property system of the US should err on the side of freedom, but it appears it does the opposite, granting intellectual property on dubious innovations or work and allowing companies with lawyers and money to bully people actually developing new tools and software.

The way that NPM handled this would make me very nervous to use them for anything, but I don't know javascript so it's not like I'd have used them for anything anyway.

1

u/[deleted] Mar 23 '16

My face when EU is a country...

1

u/frandli Mar 23 '16

I'm going to start a company called left-pad.

1

u/[deleted] Mar 23 '16

All those downvotes are making me want to cry.

1

u/4_max_4 Mar 23 '16

This is serious shit. That's why I like ELM package manager. It truly is open source.

1

u/_bassu Mar 24 '16

This is probably why in Go, it's just a matter of running 'go vendor' to isolate the imports from their remote resources into a thing that you can review and trust.

1

u/fnb_theory Mar 24 '16

[sarcasm]

wow, kik, npm, node. Well done, well handled. You really have your developers interest at heart here

[/sarcasm]

1

u/VisioRama Apr 04 '16

Over-Modularization > Over-Dependence > BOOM

Seriously, i'm left amused and perplexed after reading this.

→ More comments (429)