GitHub hit by DDoS attack

Re:GitHub hit by DDoS attack by kowdermeister on Friday March 27, 2015 @05:18AM (#9275296)

Committing downloaded packages is not a bad practice. Yes, it can be a bit big, but otherwise I don't see much problem with it. You will be always sure that the installed packages are compatible with each other.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by astrodust on Friday March 27, 2015 @11:08AM (#9276705)

That works great until you have compiled extensions. Then it's misery.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by tsheeeep on Friday March 27, 2015 @05:20AM (#9275301)

To be sure everything that we know works together we use things like npm-shrinkwrap files. We don't like it because it makes the git changelogs a lot bigger and almost unreadable if you want to compare a pull request.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by __david__ on Friday March 27, 2015 @07:08AM (#9275575)

You could commit them to their own repository so they don't taint your main repo. Then use a submodule to pull that repo in to the main repo...

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by Already__Taken on Friday March 27, 2015 @06:05AM (#9275396)

Yes the way you should do it is with shrinwrap to ensure the consistency of your dependencies. As for the actual files if you depend on it you should have your own npm repo caching them that you deploy from and have that mirror the public one.

but for small projects or quick deploys absolutely just go ahead and commit the modules.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by STRML on Sunday March 29, 2015 @06:15AM (#9284378)

Try https://github.com/uber/npm-shrinkwrap, it produces deterministic shrinkwrap files that actually diff properly.

[ Parent | on HN ]