Doc Hawkins posted:

Uh, yeah, duh! It's the node way!

Internet Janitor posted:

I wonder how many npm modules like that wouldn't exist if JS had been designed with any sort of string formatting facility built in. For a language specifically designed with UI glue logic in mind, and which includes special syntactic sugar for describing regex patterns, it's a bizarre omission.

Doc Hawkins posted:

Uh, yeah, duh! It's the node way!

TooMuchAbstraction posted:

Honestly the thing that bugs me most about this is that apparently nobody keeps local copies of the libraries they depend on, so their build process depends on some remote package repository. Isn't that just screaming out for security leaks? Publish an innocuous library, get it incorporated into a few hundred thousand websites, make a seemingly-innocuous change with hidden ramifications, and bam, it goes live very nearly immediately.

(I mean, relying on a library for a simple string padding method is also kind of but it's understandable in the more general case to not want to reinvent the wheel)

IronDoge posted:

If you wanted to concatenate things to a string repeatedly would you:

A) Write the couple lines of code for a function that does said task

B) Look up a library and add a dependency on your project perform the task for you

Well apparently a lot of people chose option B. Unfortunately for them, the author decided he was going to stick it to the man and unpublished his code from the NPM repository. Which left a lot of people with broken builds. Apparently it was so important it caught NPM's attention and they even rushed to un-un-publish it.

Behold, the code that broke a thousand builds:

code:

module.exports = leftpad;

function leftpad (str, len, ch) {
  str = String(str);

  var i = -1;

  if (!ch && ch !== 0) ch = ' ';

  len = len - str.length;

  while (++i < len) {
    str = ch + str;
  }

  return str;
}

This guy also had a couple hundred other libraries he unpublished. Extra bonus: anyone can publish a new package with the same name and new version number and inject whatever kind of code they want into people's application. lol NPM

TooMuchAbstraction posted:

Honestly the thing that bugs me most about this is that apparently nobody keeps local copies of the libraries they depend on, so their build process depends on some remote package repository. Isn't that just screaming out for security leaks? Publish an innocuous library, get it incorporated into a few hundred thousand websites, make a seemingly-innocuous change with hidden ramifications, and bam, it goes live very nearly immediately.

(I mean, relying on a library for a simple string padding method is also kind of but it's understandable in the more general case to not want to reinvent the wheel)

TooMuchAbstraction posted:

Honestly the thing that bugs me most about this is that apparently nobody keeps local copies of the libraries they depend on, so their build process depends on some remote package repository. Isn't that just screaming out for security leaks? Publish an innocuous library, get it incorporated into a few hundred thousand websites, make a seemingly-innocuous change with hidden ramifications, and bam, it goes live very nearly immediately.

quote:

Note: This module doesn't consider 0 to be a positive number and doesn't distinguish between -0 and 0. If you want to detect 0, use the positive-zero module.

dougdrums posted:

vvv Yeah now that I think about it, I take that back. I can't really blame someone if they take a glance at using autoconf for the first time and say gently caress it. It works for me though . Maybe I'm the weirdo that should start using cmake or something.

dougdrums posted:

Not only is it awkward, it's also just rude, like not putting a top-level folder in a tar/zip.

Internet Janitor posted:

Whether you care or not probably predicts which type of tools you use.

Internet Janitor posted:

If you use a CLI unpacker, archives that don't contain a top level folder can very easily explode their files into the current directory and make a mess when you blindly say "extract all". If you use a GUI unpacker you're less likely to make this mistake. Whether you care or not probably predicts which type of tools you use.

IronDoge posted:

The great thing is the guy unpublished all his stuff. So anyone who noticed in time could have published something with the same names and new version numbers and easily have exploited to god knows how many projects. I have no idea why they don't have any sort of signatures or any basic form of security.

Hammerite posted:

Less flippantly, it seems like the proper answer to this situation would be to have an option on the archive-unpacking tool that says "if the contents aren't in a top-level directory, then create one for me, named after the archive, and put the files in there instead" (or that could be the default behaviour and there could be an option to suppress it).

ExcessBLarg! posted:

TARs have top-level directories, ZIPs don't.

Ika posted:

It gets even better. The guy unpuplished all his code because some lawyer sent NPM emails claiming one of his libraries had a similar / same name as some company, and NPM took down that lib. The guy then took down all of his other code.

Kik rear end in a top hat posted:

We don’t mean to be a dick about it, but it’s a registered Trademark in most countries around the world and if you actually release an open source project called kik, our trademark lawyers are going to be banging on your door and taking down your accounts and stuff like that — and we’d have no choice but to do all that because you have to enforce trademarks or you lose them.

Azer posted:

quote:

IC 009. US 021 023 026 036 038. G & S: Computer software for use with mobile phones and portable computing devices to exchange, share and create text with other users; computer software for electronic messaging services; computer software for use with mobile phones and portable computing devices to exchange and share digital photos; computer software for use with mobile phones and portable computing devices to download audio, video, digital photos and programs; electronic payment systems, namely, a computer application software used for processing electronic payments to and from others; computer software for use with mobile phones and portable computing devices to create video and digital photos to share with other users; computer software for use with mobile phones to launch other applications and connect to other software services. FIRST USE: 20150900. FIRST USE IN COMMERCE: 20150900

IC 036. US 100 101 102. G & S: Electronic payment services

IC 038. US 100 101 104. G & S: Electronic messaging services; wireless digital messaging services; telecommunications services, namely, electronic transmission of text messages; telecommunications services, namely, electronic transmission of digital photos; telecommunications services, namely, electronic transmission of audio, video, digital photos and computer programs; computer services, namely, providing interactive technology that allows users to create video and share audio and video with other users; telecommunications services, namely, providing computer software services for use with mobile phones and portable computing devices to create video and digital photos to share with other users. FIRST USE: 20150900. FIRST USE IN COMMERCE: 20150900

Hammerite posted:

My perception of people who prefer to use command-line tools over GUI ones is that they're the kind of people who feel that they know what they're doing and like to have full control over everything at the cost of some user-friendliness. If you deliberately put yourself in that position then tbh it seems to me you can't complain when you then have to take extra care around things like that.

pokeyman posted:

I must be missing the part of this trademark that covers a dozen lines of JavaScript to poorly pad strings:

quote:

There’s a package called isArray that has 880,000 downloads a day, and 18 million downloads in February of 2016. It has 72 dependent NPM packages. Here’s it’s entire 1 line of code: return toString.call(arr) == '[object Array]';

piratepilates posted:

The take-down of pad-left wasn't from Kik requesting it be taken down. Kik requested a package called 'kik' to be taken down, the author threw a tantrum and removed 'pad-left' only after 'kik' was removed for trademark or copyright or whatever reasons.

pokeyman posted:

Touché. I'm therefore surely missing the part of that trademark that covers "a command-line tool and a library for creating projects by using starters".

Hammerite posted:

Less flippantly, it seems like the proper answer to this situation would be to have an option on the archive-unpacking tool that says "if the contents aren't in a top-level directory, then create one for me, named after the archive, and put the files in there instead" (or that could be the default behaviour and there could be an option to suppress it).

pokeyman posted:

I must be missing the part of this trademark that covers a dozen lines of JavaScript to poorly pad strings: