8 ms·

When I first heard of the is-odd and is-even NPM packages I was sure they were a joke, yet there we are: 200K weekly downloads! Publishing the packages may have

by fmx 3y ago

When I first heard of the is-odd and is-even NPM packages I was sure they were a joke, yet there we are: 200K weekly downloads! Publishing the packages may have been the effort of one spammer, but many developers obviously chose to use them - that's the part that boggles my mind.

lvncelot 3y ago
Well, look at one of the dependents: https://www.npmjs.com/package/handlebars-helpers https://www.npmjs.com/package/handlebars-helpers - certainly a more useful npm package, but by the same author. Seldom do people actually type `npm install is-even` - there's just a jungle of transitive dependencies that can be traced back to one of jonschlinkert's many packages, which then circles back to something inane as `is-even` or `ansi-red`. I once ran a simple grep in some of my node projects - most of them had a jonschlinkert package in node_modules, certainly not through any (direct) choice of my own.
- spacechild1 3y ago
  Check out this very useful utility: https://github.com/mitsuhiko/is-jonschlinkert https://github.com/mitsuhiko/is-jonschlinkert :)
  - bryancoxwell 3y ago
    I love the release notes: > It exists.
  - password4321 3y ago
    Possibly related: https://github.com/SukkaW/nolyfill https://github.com/SukkaW/nolyfill vs. ljharb and nodejs 4
    - runarberg 3y ago
      I recently came across this issue (https://github.com/import-js/eslint-plugin-import/issues/2132 https://github.com/import-js/eslint-plugin-import/issues/213... and https://github.com/import-js/eslint-plugin-import/issues/1810 https://github.com/import-js/eslint-plugin-import/issues/181...) and man that person has really found him self a hill. What is a bit worrying though is that he is an active member and contributor to TC-39. Meaning that this kind of community hostility is very much alive among the people who rule JavaScript.
      - Ataraxic 3y ago
        View their obstinance: https://github.com/nvm-sh/nvm/issues/794 https://github.com/nvm-sh/nvm/issues/794 8 years later and despite much support for the `.node-version` file. Someone else started using the .node-version file years ago, and because all open source packages won't form a committee to standardize this file, nvm will not support it. They have a lot of hills. JS Private Properties was another.
        wk_end 3y ago
        Very often when I’m digging around GitHub Issues because of some bug or quirk or insanity in the JS ecosystem (which is often) I see someone spout the worst possible take - often being kind of a jerk about it - and when I look to see who’s responsible, very very often, ljharb’s name pops up. Often. Dogpiling on someone deep in an HN comments tree isn’t exactly the classiest thing but…never having interacted with him myself, I’ve been harbouring this low-grade antipathy towards him - nothing unhealthy, just a groan whenever I see his name on GH - for years now, and it’s cathartic and almost gratifying, given his prominence in the community, to feel seen like this. Thank you.
        deleted 3y ago
        [deleted]
        runarberg 3y ago
        I was doing some snooping around and found this earlier discussion https://news.ycombinator.com/item?id=37602923 https://news.ycombinator.com/item?id=37602923 from September 2023 (234 points, 110 comments), which I had missed at the time, very related to this current subthread, and includes posts such as these (https://news.ycombinator.com/item?id=37604635 https://news.ycombinator.com/item?id=37604635). I think we as a community really need to have a conversation about ljharb and his role in the future of our industry. If he was only a library maintainer, that would be one thing, we could just move on, find workarounds, alternatives, etc. But his involvement in TC-39 makes him one of our rulers in a non-democratic structure. That makes this different.
      - 3y ago
- fmx 3y ago
  I see, thanks. I guess that answers one question, but raises another: why have his packages depend on more of his packages? If his goal was to be included in as many node_modules directories as possible, and handlebars-helpers was already included what's the point of pulling in is-odd/is-even, too?
  - ncruces 3y ago
    Makes is-odd/is-even popular; many downloads; raises their (and his) profile.
  - peteradio 3y ago
    He could sell rights to the repos and disavow any knowledge of its maintenance while maintaining the link in his own repos. When those sold rights are used to commit some crime he has plausible deniability as anyone else but got a payday. If you try spinning off the subpackage just prior to a sale then it shows some sort of intent.
    - School-Cotton 3y ago
      Is there any evidence that he has ever done anything like this, or that he plans to? Or is this just pure speculation?
      - peteradio 3y ago
        I didn't declare he's done this only that it is a vulnerability of depending on those packages.
  - plufz 3y ago
    Might be this from his GitHub bio “Several years ago, just before my 40th birthday, I switched careers from sales, marketing and consulting to learn how to program” Good way to get more eyeballs…
    - fmx 3y ago
      Ah yes, that actually explains a lot! Thanks.
- Levitz 3y ago
  Would it be considered bad practice or in poor taste to make pull requests in projects with the sole objective of implementing is-even natively? Thinking of being the change I want to see in the world.
  - verandaguy 3y ago
    It’s probably contextual but I’d say it’s in poor taste to use them in the first place. Removing them is a net benefit imo.
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
divbzero 3y ago
I did learn one new thing from browsing the is-odd source code: Number.isSafeInteger(n) checks that n falls within the [Number.MIN_SAFE_INTEGER, Number.MAX_SAFE_INTEGER] interval. ... if (!Number.isSafeInteger(n)) { throw new Error('value exceeds maximum safe integer'); } ...
- skitter 3y ago
  Shouldn't this simply return true instead of throwing?
brainzap 3y ago
the bigger joke is that programming language have no built in
- fifilura 3y ago
  Huh? Did you miss the modulo operator?
  - kristopolous 3y ago
    It wouldn't have 200k downloads a week unless there was a large number of programmers who didn't know how to do it. I mean we're talking FizzBuzz secret sauce here. This must be total black magic for a catastrophic percentage of programmers
    - RugnirViking 3y ago
      A more catastrophic number of programmers a) dont know how dependencies work and b) think everyone else are idiots.
      - kristopolous 3y ago
        Perhaps, I solidly understand how dependencies work and in this case my observation is defensible Someone made the decision to use that and someone thought using stuff made by a person's who makes those kinds of decisions was a good idea and so on. You can git blame dependencies all the way down and research the parties involved. I've done it, built tools for it even. A stack of people who make bad decisions doesn't make good software.
        robertlagrant 3y ago
        More likely the author made another, more useful, package that uses it.
    - arzig 3y ago
      I have not read the source but I had always assumed that this was the lovingly crafted effort of someone who is intimately familiar with the js standard making sure that some hypothetical expression like ![1] is neither odd nor even. Surely the idea that modulo is beyond developers is too horrifying to contemplate.
Lamad1234 3y ago
[dead]
paulddraper 3y ago
Often the is-even package will be imported by another (less ridiculous) package of the same author.

by fmx 3y ago

lvncelot 3y ago

Well, look at one of the dependents: https://www.npmjs.com/package/handlebars-helpers https://www.npmjs.com/package/handlebars-helpers - certainly a more useful npm package, but by the same author. Seldom do people actually type `npm install is-even` - there's just a jungle of transitive dependencies that can be traced back to one of jonschlinkert's many packages, which then circles back to something inane as `is-even` or `ansi-red`. I once ran a simple grep in some of my node projects - most of them had a jonschlinkert package in node_modules, certainly not through any (direct) choice of my own.

spacechild1 3y ago
Check out this very useful utility: https://github.com/mitsuhiko/is-jonschlinkert https://github.com/mitsuhiko/is-jonschlinkert :)
- bryancoxwell 3y ago
  I love the release notes: > It exists.
- password4321 3y ago
  Possibly related: https://github.com/SukkaW/nolyfill https://github.com/SukkaW/nolyfill vs. ljharb and nodejs 4
  - runarberg 3y ago
    I recently came across this issue (https://github.com/import-js/eslint-plugin-import/issues/2132 https://github.com/import-js/eslint-plugin-import/issues/213... and https://github.com/import-js/eslint-plugin-import/issues/1810 https://github.com/import-js/eslint-plugin-import/issues/181...) and man that person has really found him self a hill. What is a bit worrying though is that he is an active member and contributor to TC-39. Meaning that this kind of community hostility is very much alive among the people who rule JavaScript.
    - Ataraxic 3y ago
      View their obstinance: https://github.com/nvm-sh/nvm/issues/794 https://github.com/nvm-sh/nvm/issues/794 8 years later and despite much support for the `.node-version` file. Someone else started using the .node-version file years ago, and because all open source packages won't form a committee to standardize this file, nvm will not support it. They have a lot of hills. JS Private Properties was another.
      - wk_end 3y ago
        Very often when I’m digging around GitHub Issues because of some bug or quirk or insanity in the JS ecosystem (which is often) I see someone spout the worst possible take - often being kind of a jerk about it - and when I look to see who’s responsible, very very often, ljharb’s name pops up. Often. Dogpiling on someone deep in an HN comments tree isn’t exactly the classiest thing but…never having interacted with him myself, I’ve been harbouring this low-grade antipathy towards him - nothing unhealthy, just a groan whenever I see his name on GH - for years now, and it’s cathartic and almost gratifying, given his prominence in the community, to feel seen like this. Thank you.
        deleted 3y ago
        [deleted]
        runarberg 3y ago
        I was doing some snooping around and found this earlier discussion https://news.ycombinator.com/item?id=37602923 https://news.ycombinator.com/item?id=37602923 from September 2023 (234 points, 110 comments), which I had missed at the time, very related to this current subthread, and includes posts such as these (https://news.ycombinator.com/item?id=37604635 https://news.ycombinator.com/item?id=37604635). I think we as a community really need to have a conversation about ljharb and his role in the future of our industry. If he was only a library maintainer, that would be one thing, we could just move on, find workarounds, alternatives, etc. But his involvement in TC-39 makes him one of our rulers in a non-democratic structure. That makes this different.
    - 3y ago
fmx 3y ago
I see, thanks. I guess that answers one question, but raises another: why have his packages depend on more of his packages? If his goal was to be included in as many node_modules directories as possible, and handlebars-helpers was already included what's the point of pulling in is-odd/is-even, too?
- ncruces 3y ago
  Makes is-odd/is-even popular; many downloads; raises their (and his) profile.
- peteradio 3y ago
  He could sell rights to the repos and disavow any knowledge of its maintenance while maintaining the link in his own repos. When those sold rights are used to commit some crime he has plausible deniability as anyone else but got a payday. If you try spinning off the subpackage just prior to a sale then it shows some sort of intent.
  - School-Cotton 3y ago
    Is there any evidence that he has ever done anything like this, or that he plans to? Or is this just pure speculation?
    - peteradio 3y ago
      I didn't declare he's done this only that it is a vulnerability of depending on those packages.
- plufz 3y ago
  Might be this from his GitHub bio “Several years ago, just before my 40th birthday, I switched careers from sales, marketing and consulting to learn how to program” Good way to get more eyeballs…
  - fmx 3y ago
    Ah yes, that actually explains a lot! Thanks.
Levitz 3y ago
Would it be considered bad practice or in poor taste to make pull requests in projects with the sole objective of implementing is-even natively? Thinking of being the change I want to see in the world.
- verandaguy 3y ago
  It’s probably contextual but I’d say it’s in poor taste to use them in the first place. Removing them is a net benefit imo.
deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

divbzero 3y ago

I did learn one new thing from browsing the is-odd source code: Number.isSafeInteger(n) checks that n falls within the [Number.MIN_SAFE_INTEGER, Number.MAX_SAFE_INTEGER] interval. ... if (!Number.isSafeInteger(n)) { throw new Error('value exceeds maximum safe integer'); } ...

skitter 3y ago
Shouldn't this simply return true instead of throwing?

brainzap 3y ago

the bigger joke is that programming language have no built in

fifilura 3y ago
Huh? Did you miss the modulo operator?
- kristopolous 3y ago
  It wouldn't have 200k downloads a week unless there was a large number of programmers who didn't know how to do it. I mean we're talking FizzBuzz secret sauce here. This must be total black magic for a catastrophic percentage of programmers
  - RugnirViking 3y ago
    A more catastrophic number of programmers a) dont know how dependencies work and b) think everyone else are idiots.
    - kristopolous 3y ago
      Perhaps, I solidly understand how dependencies work and in this case my observation is defensible Someone made the decision to use that and someone thought using stuff made by a person's who makes those kinds of decisions was a good idea and so on. You can git blame dependencies all the way down and research the parties involved. I've done it, built tools for it even. A stack of people who make bad decisions doesn't make good software.
      - robertlagrant 3y ago
        More likely the author made another, more useful, package that uses it.
  - arzig 3y ago
    I have not read the source but I had always assumed that this was the lovingly crafted effort of someone who is intimately familiar with the js standard making sure that some hypothetical expression like ![1] is neither odd nor even. Surely the idea that modulo is beyond developers is too horrifying to contemplate.

Lamad1234 3y ago

[dead]

paulddraper 3y ago

Often the is-even package will be imported by another (less ridiculous) package of the same author.