It's because you haven't read al-Ghazali yet.
(definitely the most pompous and self-important part of this post)
“first, they didn't look at the dates of the emails. They don't understand the timeline.
second, they can't relate to standing your ground in a high pressure situation involving threats.
and third, they haven't read Al-Ghazali yet, don't quite understand how (free) people make decisions”
When was the last time you were threatened (“will bang in your doors” “take down your accounts”) by a company like Kik and you defended the principles and values you believed?
I’m quite familiar with both western and eastern traditions, don’t know any better source than Ghazali’s “the alchemy of happiness” about how people make decisions.
It’s kind of ironic to see people being triggered by just the mention of it though — just reflects what your heart tends to reject impulsively. I wish you curiosity.
^ You see how pompous and insufferable this sounds?
Let's put the same sentence:
"I'd love to explain to you, but if you haven't read $SOURCE_MATERIAL, you wouldn't understand it anyway".
Does it sound pompous and insufferable?
Of course we can agree to disagree. I'm not trying to win anything, but just express my perspective.
Have a nice day!
Politely pushes forward a freshly brewed mug of tea across the counter.
If getting wisdom from others is not your thing, I can respect that, but low-key insulting them for leaving you pointers for a more enlightened place is rude.
You can instead say "I don't understand why Al-Ghazali relates to this", and that would be completely OK.
Lastly, it's fine to quote someone but you need to explain how it's relevant to the conversation. The author could have summarised al-Ghazali's idea about free will or whatever and it would have been fine. But he didn't even bother, as if the ideas so basic and well known that it's not even worth doing.
I'm pretty comfortable with the way I've poked fun at the author's pompousness. If you need further explanation it's because you haven't read Chanakya yet.
I don't think that you're pompous because you cited somebody I don't know that existed. I'm not a god. People show me things I don't know, I take note of them.
Maybe I won't agree with the direction you show me, but at least I have a new direction to discover.
This is the difference.
Incidentally, HTTP has a status code for this. It’s 410 - Gone.
Which is devised for exactly this purpose.
This is all documented in Wikipedia accurately:
NPM had written rules and they violated their own rules for Kik. I asked them to remove all my packages. They gave me a script to run. The process took about a week, it was not sudden or unexpected.
When I realized it had the impact we saw after the unpublish, I gave away all my packages immediately, other devs took ownership of the packages and re-publish. Everything was back to normal within hours.
“Oh it’s all npm’s fault, I just ran a script” - this is what a child unable to take responsibility for his actions says. And you were most certainly a child, wanting to take your toys home with you when your feelings got hurt. You can blame npm all you like, but no one is buying that. You had the choice between accepting it like an adult, or hurting other people by taking your toys home, and you chose the latter. Npm didn’t choose. You did.
Judging by the fact that you’re still trolling on this thread left and right a decade later, unable to take responsibility for your actions, blaming everyone but yourself - you haven’t changed even little. You’re still a child, and you likely always will be.
One thing has changed for the better though, thanks to your tantrum. They didn’t have the legal policy or ToS in place from preventing you doing what you did. They’ve changed that now, it’s no longer possible for people to unpublish packages anymore like you did.
Yes, they have asked NPM to remove all of their packages. It's on them. NPM didn't do it, but gave a tool to do it themselves.
I deserted GitHub the day Copilot came online. I archived my repositories just because I didn't want broken links on comments and notes I have written god knows where.
I stopped uploading photos to Instagram the day they started doing AI training with my images. I didn't delete them because my partner likes them.
I can delete these repositories, photos, whatever I have online. I have no obligation to anyone. It's same for them. It's their code they developed by themselves. They can delete them, and just don't care what happens next.
Why this freedom bothers you that much?
P.S.: We don't do ad-hominem attacks here. Please refer to guidelines for more information. Thanks for your cooperation.
You’ve written so much, forgetting one basic thing about open source - he granted an irrevocable legal license to use every published version of his software. The MIT license isn’t just words, it contains enforceable legal rights. He broke other people’s software when he had no right to.
That’s the difference between unpublishing software and removing photos from Instagram. Understand that before jumping to his defence.
You talk like you know so much about HN. Why don’t you try deleting a comment of yours older than 2 hours. You’ve never tried it? Perhaps because you don’t know as much as you think you do. HN policy is that you don’t own the comments you’ve made, because a comment section is a tapestry created through collaboration. A petulant child wanting to destroy tapestries they’ve participated in will be told politely “no”.
You’re so keen to preach HN rules? Preach it to your fellow countryman that you’re stanning so hard. There’s only one flagged comment on this thread and it’s his.
Also, it unfortunately isn't the first time you've done this (e.g. https://news.ycombinator.com/item?id=42565389), although it seems to be the first time you jumped into a full-blown flamewar. Please don't do it again. We have to ban users that abuse the site like this, and I don't want to ban you.
If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of HN more to heart, we'd be grateful.
When I was writing these replies, there were no flagged comments, and if there were, I can see them, if I want. That's an option you can change. I'm sure you know this better than me. You're here since 2014, and I'm here since 2017. Our comment histories are open. You can check whether I'm a sockpuppet or not.
The MIT license doesn't tell anything about availability of the source. In fact, MIT licensed software doesn't have to be Open Source at all. I can get the source, modify, compile and distribute the binaries without the source code attached, and no one can compel me about opening the source code. That's a requirement set forth by GPL family, and even these say that source should be available for a reasonable amount of time, not indefinitely, and certainly not online. IOW, I can sell GPL software, without putting its source code online. The only obligation is to provide the source to the people who have gotten the software (i.e.: How RedHat operates).
My only example was not my Instagram photos. I have also talked about my GitHub repositories (which I am not deleting because of my personal reasons), and again, I'm not here to defend them. To reiterate, I'm a completely different human being who happens to disagree with you.
HN's no delete policy was there since I joined, and I agreed to this when I started participating here. If they do something which is against my values, I'll leave this place, too (like I left Reddit back in the day). I'm not afraid to put my values first. In fact, this is why I have replied to you this much. I'm putting forward my perspective and values, which is not defending someone. I'm a lone person, walking my own way.
Your prejudice and anger is blocking your view. Currently three comments of you are also flagged.
It's enough that you're reflecting your beliefs and prejudices to other people in the form of low-key insults. Also your tea is going cold. It's not polite to not aceept a friendship drink offered in good faith.
This is my last reply on this comment thread, because this is a new day, and I have to handle other matters, too. Without any hard feelings, I wish you the best of luck, and have a nice day.
See you around.
https://news.ycombinator.com/newsguidelines.html
Please don't, regardless of how annoying someone else is or you feel they are. We ban accounts that abuse the site like this, and as I told you that last time this came up, I don't want to ban you.
Edit: this has unfortunately been a problem for a long time:
https://news.ycombinator.com/item?id=39173389 (Jan 2024)
https://news.ycombinator.com/item?id=39173369 (Jan 2024)
https://news.ycombinator.com/item?id=34318179 (Jan 2023)
https://news.ycombinator.com/item?id=29957666 (Jan 2022)
https://news.ycombinator.com/item?id=29957627 (Jan 2022)
https://news.ycombinator.com/item?id=26127667 (Feb 2021)
https://news.ycombinator.com/item?id=13804804 (March 2017)
Interesting monologs here. I wish you best in this, have a nice day!
> And third, they haven't read Al-Ghazali, don't quite understand how I make decisions.
Not everyone makes decision guided by the heart. Many people lean more on reason and logic.
Yes, when theres's no impulse strong enough to outweigh reasoning. You don't need Ghazali for this, Kant also explains it. Before suggesting that I rephrase things, I think you should explore the domain first.
BS -- What's your familiarity with what you're talking about?
> Do you not agree that some people would not have made the same decision as you did back then?
:facepalm:
I don't know that I fully buy this either, at least not the anger part.
I can look back on all this with wry amusement nowadays but I remember it being pretty frustrating at the time.
It sort of felt like, well, either you knew what the impact of unpublishing all your packages would be and you did it anyway, which makes you kind of antisocial, or you didn't know what the impact would be but did it anyway, which makes you kind of a hothead. And in this latest piece Azer has admitted that he didn't understand what the impact would be so... y'know... I do wonder if anger was at least a small factor.
Regardless, it's pretty clear that npm bear a lot of the responsibility for what happened. It's also something that happened a very long time ago and, as I've already implied, is just a funny story nowadays, not something I can manage any ire towards Azer over.
He wants to remove his stuff, but isn't sure what the right way to do it is, so he asks npm. npm provides him with a set of scripts to run to remove his stuff, and he, presuming that it's "ok" if npm told him to go ahead and run them, runs them. The impact isn't especially important to him, But since npm just gave him a set of scripts with an implicit "oh okay you want to remove your stuff, here I wrote you a script you can run to get it done," makes it more of an npm choice to handle it in this manner. npm asked him to handle it this way, so he did.
If NPM would have prevented the depublishing, he would have made a scene and in the worst case, they would have looked bad.
How they actually handled it, the library author got full freedom but also full responsibility
I mean he says he asked them to remove all his packages, expecting them to do so gradually, following whatever mitigation strategy they felt appropriate (e.g. some kind of warning and fadeout process), and instead they gave him a script to do it immediately so he did that.
That’s precisely why unpublishing an entire package/crate/gem is not a supported operation on any mainstream repository.
This guy is just an asshole who wanted to lash out at everyone because he felt hurt by npm’s actions. Npm had two options: tell him to kick rocks or give him the script they gave him.
Ironically if they had declined his request, public opinion wouldn’t have been with them. Nor could they change their terms of service retrospectively, they were on shaky legal ground. They had no choice but to allow him to fuck with the whole internet and then later change their terms of service.
No software developer or organisation will use a software repository that allows deletion of packages. That’s why it’s not a thing anymore.
If you think this “right” should exist, that’s a market niche for you to exploit. But you won’t, will you? Because like I said, no user wants this.
The point is that Azer didn't owe anybody anything; not even to know what he was doing. npm did.
That said, I'm glad the wake-up call came in such a relatively benign way.
Every competent repository has a process for unpublishing. Sooner or later someone will upload something that someone else claims the copyright to, and then either you take it down when you get a DMCA notice or you lose your safe harbour.
Maybe you replace it with some sort of tombstone. Maybe you warn all the reverse dependencies first. But you have to have a way to remove content.
Lesson: Vendor your dependencies, I guess. Although a lot of the ire around left-pad was programmers using a library for something so trivial, but that's a different conversation.
Very true.
Although, from 2012 onwards, up to around the time of the leftpad incident, the trend - and the pressure - was to minimise the amount of work your code was doing and to publish tiny packages that only did one thing or solved one problem, deferring to other tiny packages for anything non-core. I remember colleagues more embedded in the JS world than I was passionately arguing for this in 2012/13.
And it did make some sense: bandwidth matters, particularly on mobile devices (which became a key source of traffic during that period) so why pull in some gigantic do everything library when you only need a handful of functions[0]? Sure, minifying and pruning help but, due to JS's nature, pruning can only get you so far.
But, yes, I think leftpad was something of a teaching moment on the downsides of this approach.
[0] Of course, if you then stick 6 different tracking scripts in all your pages, it's super-easy to undo all the good you've done by minimising your bundle size, but that's a different conversation.
As opposed to looking much worse? Easy decision.
Being neutral and seeing a good way forward is not something practiced, taught or celebrated in western, esp. American culture much. One always needs to have a thrust source (mostly an emotion driven by logic, taught during being grown up (e.g.: You should be angry about it)) to make decisions.
In fact, sometimes, you just don't have a thrust source, you just feel like doing it. It feels the right thing to do, and you do it with no emotions attached.
This is a boon, in fact it's called "clarity" brought by being with yourself. Either spending time outdoors, doing some reflection work, or by meditating. I use the same methods when I face with a non-urgent but important decision. Let the way reveal itself. Putting logic and emotions aside and finding the right way is not easy, or the process is not smooth sailing, but I never arrived to a wrong place by following that path.
This whole problem was trivially avoidable, and people get mad at him because they were too lazy to avoid it.
Lots of people made a big mistake, they found out the hard way. Lesson learned.
grant me the serenity to accept the things I cannot change; courage to change the things I can; and wisdom to know the difference
So, im gonna try and read something by al-Ghazali.
When this happened, people started making assumptions. A few of them:
1. I’m irrational 2. I’m angry 3. I’m greedy
They came to one of these conclusions, based on how they see themselves in the same position.
I can be of course one of these three in some other situations, but in the left pad incident, I done all purely with my heart, to stick to my values and principles which was behind my motivation to do open source for such a long time.
Ghazali is the best source I’m aware of about how to put heart in the driver seat of life, and without fighting but using logic, greed, anger etc as tools.
If my reference made curious about him, I couldn’t be more happy. Here’s a great lecture about his book, The Alchemy of Happiness: https://youtube.com/watch?v=zBwWc0DflRQ
One thing I have learned about al-Ghazali today, thanks to your efforts, is that philosophers aren't always right, faith and logic can work together, and doubting everything can lead to truth.
But, most importantly, live ones faith honestly - and this is especially true for those of us who detest imperialist/corporate interference in spiritual activities, such as publishing packages to the npm ecosystem intended to make ones fellow human beings lives' more rewarding, in spite of the lack of personal rewards to be gained in doing so.. that the value in seeing this is lost on a lot of HN responses in this thread so far, is no big surprise - but it is surely disappointing.
I hope you will consider adding Aquinus and Augustine of Hippo to your references, also. Sometimes it helps to see how the universality of true philosophy crosses cultural divides.
What compels you to say this? Would you be more satisfied if he'd suggested the reader acquaint themselves with Thomas Aquinas or Augustine of Hippo? Are you familiar with al-Ghazali, the scholar, or is he new to you?
You have, rather literally, proven the philosophers point - while remaining, it seems, ignorant of it.
Or perhaps, you mean to imply that /u/akoculu was doing a good deed not because he cared, but to show off?
The irony is, al-Ghazali asked his readers to question their pomp and self-importance, and to do good deeds because they truly cared, not because it would result in social acknowledgement by the mass collective, whose motives should always be questioned, effectively.
Perhaps, then, your position is more of a reflection of your own condition? One would hope your disdain is borne on an actual understanding of al-Ghazali's position, vis a vis self-doubt ... or rather, one would hope your current position is based on an ignorance of his works, actually.
One should never feel so compelled to deny the enlightenment of others, especially if by doing so, you resort to personally-motivated obscurantism in response.
"Eschew flamebait. Avoid generic tangents."
"Edit out swipes."
https://news.ycombinator.com/newsguidelines.html
We detached this subthread from https://news.ycombinator.com/item?id=44245579.
I think the left-pad incident helped shatter that myth. He we had huge packages depending on a package which padded a string in an inefficient manner.
It turns out that the many eyeballs of the bazaar had averted their gaze from what was actually happening, which is a system of impossible to audit dependency chains.
I think it also shows the impact of using a language with a poor standard library.
Padding is absolutely something that should be available as an extension over String.
If JavaScript were controlled in the same manner that Go, Rust, Java, .NET, python etc, then it would have been added years ago.
Apparently it has now finally arrived in ES2026: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
In what way? Have the dependency trees gotten significantly smaller since then?
I installed `pass` (the lightweight password manager) on a fresh headless system the other day and it brought in like 60 packages including a bunch of X stuff.
Installing 'pass' pulled in: desktop-file-utils emacs-filesystem git-core libpng qrencode qrencode-libs
Plus weak (optional) dependencies: libwayland-client mailcap wl-clipboard xdg-utils
12 packages, 5 MB download, 24 MB installed. Could be worse, could be better.
I was honestly expecting Fedora to have less than that.
One of the big trigger is the dependency pass->xclip. That sets off a big cascade of X.
ES2017 [1]. The MDN docs always link the latest version of the spec; the year in the link doesn't correspond to the version where it was added. The proposal was already mostly done at the time of the incident [2]
[1] https://tc39.es/ecma262/2017/#sec-string.prototype.padstart [2] https://github.com/tc39/proposal-string-pad-start-end
The man page for a unix binary is at least two orders of magnitude larger. At some point, the "Unix philosophy" doesn't make sense anymore. I mean, it couldn't even rightpad.
oh look at me, 589 published packages on npm! with 5 700 quadripillion weekly installs!
The author simply ran the script that NPM themselves told him to, and later NPM blamed the author for their own failings.
But I do agree now that the author isn't really to blame.
They do in fact curate the registry, mainly for reporting vulnerabilities to consumers and to remove malicious packages.
That said, this seems like a weird argument to me:
> but I still don't understand why NPM didn't take the time to find out if any of my modules were widely used and consider ways to handle the unpublishing without breaking anything
Sure, NPM's unpublish mechanism was a misdesign, but is he saying that he expected people at the company to manually go through this every time someone did an unpublish? That doesn't seem too reasonable IMO, NPM the company isn't curating NPM the registry. They host it as a public service.
I can't fault the author all too much here though, if he hadn't triggered "the left-pad incident" then someone else would've not too long after. NPM fixed the problem, by means of a better unpublish policy [0] and that's that.
[0] https://docs.npmjs.com/policies/unpublish#packages-published...