Big brain tech dude got yet another clueless take over at HackerNews etc? Here's the place to vent. Orange site, VC foolishness, all welcome.
This is not debate club. Unless it’s amusing debate.
For actually-good tech, you want our NotAwfulTech community
The commenters on HN and lobste.rs are generally on the side of the package creators, with the view that NPM is run by GitHub, who is owned by Microsoft. All this is true, but it doesn't follow from that that the NPM people are paid fuck-you money. I suspect they're understaffed, and overworked, and that this stunt didn't make them very happy.
Although in retrospect, not anticipating that some rando would try to depend on everything in the repository seems like a naive view on human nature.
there's probably a few people trying this in every other language ritenao
guess we'll find out in a few weeks!
An interesting read in general but the writers proclaiming themselves ethical hackers in the opening paragraph only to turn into wittle birthday boys as soon as it turned out their uh experiment caused major disruptions was mildly off putting.
A really good lesson on offline backups of things like issue trackers, though.
when I first did this for a project a couple of years ago, the github api endpoint for this sucked extremely bad. I no longer remember all the details but it was something like 3 different sets of things you had to get to make sure you had somewhat of a full picture. might be better these days. and even then it's still only the first piece in the puzzle
but yeah, by and large a rather extreme percentage of the modern industry is extremely dependent on a vary narrow scope of SPoFs, and may are clueless about how to even approach this. 2 decades of computer-renting, yay!
Okay, I might be brainfarting here, but... why is blocking _un_publishing such a big deal? I understand that it might be annoying, but this talks about it like it broke the fucking system, as if it was as important as actually publishing packages.
How often do people in JS world unpublish packages?
seems like a perfectly normal thing to do to me. maybe you uploaded it under the wrong account, or licensing change, or need to do a security- or danger-related retraction, or ...
hell, maybe you just changed your mind! that's allowed too! or should be
I totally get that it's a normal thing and it is a disruption of service, but it doesn't strike me as "everybody freak out".
If, say, Lemmy stopped you from deleting your comments for 24h few would even notice.
I am guessing* that the "everybody freak out" part happened when the extent became evident and everyone realized all of npm was suddenly unpublishable, not so much because everyone individually freaked out individually immediately.
*extrapolating from the NPM community being described as frustrated but mostly forgiving.