News for hackers. Stuff that matters.
Re:What NPM should do to stop a new colors attack by arcticbull on Tuesday January 11, 2022 @03:33PM (#29897421)
> Now you can't publish something online without an army making frankly toxic demands on your time because they feel there is something wrong with what you made.

Asking you not to intentionally break a package you know 20,000+ products rely on as a result of your representations hardly seems like a toxic demand on their time. They hadn't committed to the project in over three years. All they had to do was continue not committing to it.

Asking them to find a new maintainer or not intentionally wreck other people's work that relies on it isn't a toxic demand, it's asking for a modicum of respect.

I'm not saying you have to keep building sandcastles, im saying if you decide to stop for whatever reason its not a toxic demand to ask you not to knock over 20,000 other sandcastles on your way out - out of spite.

This feels like a clear case of stupid games -> stupid prizes.

Re:What NPM should do to stop a new colors attack by zepolen on Tuesday January 11, 2022 @05:21PM (#29899009)
That analogy needs rephrasing, the OP built a sandcastle and left instructions on how to build it which 20,000 other people used to build (their own) sandcastles.

Then the OP decided to make a new change for his own castle.

"Draw a vulgar expression on the front door."

Which 20,000 people blindly copied and then have the audacity to complain about.

Re:What NPM should do to stop a new colors attack by arcticbull on Tuesday January 11, 2022 @07:59PM (#29900908)
It's not audacity to use a piece of software in the way it was made available on the terms under which it was made available. What is audacious is simply rugging everyone that took you at your word.

[edit] To be honest you're not even advocating for a coherent model of open source software. Should everybody consuming every library fork it in case the author throws a tantrum? That hardly seems workable. The author didn't just stomp on big company sandcastles, the author knocked over everyone's. Every pet project, every startup getting off the ground.

For what? Sellers remorse. Author wrote something and gave it away, then regretted giving it away. Sorry.

Re:What NPM should do to stop a new colors attack by zepolen on Tuesday January 11, 2022 @11:27PM (#29902296)
> Should everybody consuming every library fork it in case the author throws a tantrum?

Yes you should always fork open source projects critical to your project that are not mirrored somewhere safe, you never know when they may be inadvertently deleted, that's just common sense.

For dependencies, simply pin your versions and put library upgrades through a code review, that way no unknown code enters your system. Or just wait a couple days after a new release, the shit will hit the fan from all the incompetents.

> That hardly seems workable

Right, no one wants to do the work.

> For what? Sellers remorse. Author wrote something and gave it away, then regretted giving it away. Sorry.

For what? Buyers remorse. You blindly pulled code without looking at it, then regretted pulling it. Sorry.

Re:What NPM should do to stop a new colors attack by arcticbull on Tuesday January 11, 2022 @11:56PM (#29902506)
> For dependencies, simply pin your versions and put library upgrades through a code review, that way no unknown code enters your system.

These are all solid recommendations but don't excuse shit behavior on behalf of certain poor participants in the ecosystem. Which it seems you're super eager to do for some reason.

> Right, no one wants to do the work.

I mean so far it looks like one guy lol.

> For what? Buyers remorse. You blindly pulled code without looking at it, then regretted pulling it. Sorry.

We're talking about this guy's motivations not that of the consumers.

Re:What NPM should do to stop a new colors attack by zepolen on Thursday January 13, 2022 @02:10AM (#29917721)
> don't excuse shit behavior on behalf of certain poor participants in the ecosystem

Why not? You are excusing the incompetence of everyone affected by this.