7 ms·

Left-Pad (2024)

291 points by oeitho 1y ago

lpln3452 1y ago
A closer look at the sequence of events makes it clear that the failures weren’t due to the package author. He fulfilled his responsibilities as a author.
asdoi 1y ago
[flagged]
- junon 1y ago
  Not really. Please don't flagrantly disregard the author. That tone solves nothing.
deleted 1y ago
[deleted]
skrebbel 1y ago
I have to admit that I don't understand half of this blog post, feels like I'm missing some context, but I do like that the "left pad guy" does a post mortem. That said, this seems like a weird argument to me: > but I still don't understand why NPM didn't take the time to find out if any of my modules were widely used and consider ways to handle the unpublishing without breaking anything Sure, NPM's unpublish mechanism was a misdesign, but is he saying that he expected people at the company to manually go through this every time someone did an unpublish? That doesn't seem too reasonable IMO, NPM the company isn't curating NPM the registry. They host it as a public service. I can't fault the author all too much here though, if he hadn't triggered "the left-pad incident" then someone else would've not too long after. NPM fixed the problem, by means of a better unpublish policy [0] and that's that. [0] https://docs.npmjs.com/policies/unpublish#packages-published-more-than-72-hours-ago https://docs.npmjs.com/policies/unpublish#packages-published...
- nicou 1y ago
  For context, see https://en.wikipedia.org/wiki/Npm_left-pad_incident https://en.wikipedia.org/wiki/Npm_left-pad_incident
  - HPsquared 1y ago
    11 lines of code! Wow. I had no idea it was that small.
    - rootlocus 1y ago
      > Most of my open source work followed Unix philosophy, so the packages did one thing at a time. There was 350+ of them. The man page for a unix binary is at least two orders of magnitude larger. At some point, the "Unix philosophy" doesn't make sense anymore. I mean, it couldn't even rightpad.
      - baobabKoodaa 1y ago
        packages like `left-pad` should really be named more like `resume-pad` oh look at me, 589 published packages on npm! with 5 700 quadripillion weekly installs!
      - another-dave 1y ago
        When the metadata for the package is larger than the source code you've probably gone too small!
    - ThinkBeat 1y ago
      oh there are thousands of those out there on npm. Short and trivial code. Even if you do not use them at all in your own codebase chances are quite high that some package you do use, uses some of those tiny packages.
    - xnorswap 1y ago
      There used to be the general wisdom of, "Don't re-invent the wheel. Let the hive-mind craft utility functions and use those because they'll be battle-hardened, well tested, and you can focus on your core business". I think the left-pad incident helped shatter that myth. He we had huge packages depending on a package which padded a string in an inefficient manner. It turns out that the many eyeballs of the bazaar had averted their gaze from what was actually happening, which is a system of impossible to audit dependency chains. I think it also shows the impact of using a language with a poor standard library. Padding is absolutely something that should be available as an extension over String. If JavaScript were controlled in the same manner that Go, Rust, Java, .NET, python etc, then it would have been added years ago. Apparently it has now finally arrived in ES2026: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/padStart https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
_thisdot 1y ago
Relevant discussion from the time left-pad incident happened - https://news.ycombinator.com/item?id=11349870 https://news.ycombinator.com/item?id=11349870
arturocamembert 1y ago
left-pad even being a package is pretty funny, no? How many bytes got pumped across CDNs, proxies, build pipelines, etc. just to write a tiny utility function? I'm all for taking advantage of existing solutions, but I can't wrap my head around needing to pad a string and thinking "oh, I bet there's a package for that"
- codegladiator 1y ago
  maximum code reuse flex, copy-paste is for losers.
- wiseowise 1y ago
  Muh Unix way.
- arcastroe 1y ago
  The package's original implementation[1] also seems like it would have resulted in O(n^2) operation rather than desired O(n). [1] https://en.wikipedia.org/wiki/Npm_left-pad_incident https://en.wikipedia.org/wiki/Npm_left-pad_incident
  - hhjinks 1y ago
    I don't see where the quadratic time complexity comes from. There's a single loop performing n operations in total, ie. O(n).
    - barbegal 1y ago
      In each loop prepending a single character could take O(m) (moving all m characters one to the right) so combined O(nm) where n is the number of padding characters and m is the total number of characters in the string.
      - lifthrasiir 1y ago
        Only when the underlying JS implementation does this naively. In reality JS implementations do a lot of optimizations which often can reduce the time complexity.
lloydatkinson 1y ago
> On the NPM side, I observed general condescending attitude towards developers, which led them make series of unreasonable decisions and ultimately blame me for all the cost. NPM has not really learned much in the time since this event either.
aa-jv 1y ago
As someone who avoids javascript and its attendant ecosystem like its the Visual Basic plague of the 21st Century, the most interesting aspect of this whole story is the fact that Koçulu disconnected from the tech scene for some time, did some amazing hiking and camping and trail discovery, and now .. 8 years later .. still feels compelled to explain himself. Technology is a fickle muse. We nerds obsess over her and degrade ourselves in her service, but she always calls us back into the light. As someone who was around for the Morris worm and spent weeks negating its impact, I feel that there is a fundamental issue impacting our ability to make world-changing technology with the current tools. The less we strive to understand the organizational (ethical) failings of technology, the less technology can be used to effect productive change in the realms it is being applied. That said, I'm about a month (and a few hundred failed compiles) away from taking my own sabbatical, and I can't help but try to reason what things would be like for me, upon my return after some years, in the technological space I've carved out for my own needs, at much different scales and contexts. Perhaps it should become somewhat standard for us technologists to take sabbaticals, more often, and more seriously, in order to give us the context we need to understand the ethical dilemma that impinges upon our technological prowess. Koçulu, thank you for your thoughts. I may never be effected by the javascript world, but the lessons it provides from within the temple nevertheless reverberate among the outer chambers ..
shellac 1y ago
It's a minor thing, but: > Most of my open source work followed Unix philosophy, so the packages did one thing at a time. Nobody has suggested that libc -- to take the most obvious example -- is against the Unix philosophy. Debates occur around whether whether commands / daemons do too much (recent poster child being systemd) or aren't composable.
- 0xAFFFF 1y ago
  If anything, the left-pad debacle has shown that NPM package granularity has gone way too small, at a point where package overhead was outweighing the package simplicity benefits.
  - whostolemyhat 1y ago
    Left-pad was made at a time when tree-shaking wasn't really around, so it was good practice to only include the functions you needed to avoid making websites too heavy. If you just needed a small function then it'd be silly to include a huge utility library like Underscore.
    - yurishimo 1y ago
      You're missing the point. Nobody with a serious background in software development should ever need to pull in a package to pad a string or check if a number is even or odd. If someone is smart enough to use a package manager, they should be more than capable to write a function to pad a string (assuming the standard library doesn't include one already)!
      - baobabKoodaa 1y ago
        While you are correct, the problem compounds when popular package developers choose to use tiny packages. I don't need left-pad. But maybe I need react-starter-kit. Now, imagine that react-starter-kit has a dependency to markdown-js-blobber, which has a dependency to make-text-nice, which has a dependency to left-pad. In this scenario I am now "pulling in a package to pad a string". If I am "smart enough to use a package manager", I should be "more than capable to write..." an alternative to react-starter-kit..?
pstadler 1y ago
The version history of the kik package[0] is odd. It has been replaced with a security holding package nine years ago[1]. [0] https://www.npmjs.com/package/kik?activeTab=versions https://www.npmjs.com/package/kik?activeTab=versions
- manuhabitela 1y ago
  haha, so, all of this for… nothing in the end?
  - Bengalilol 1y ago
    The kik user page almost says it all. https://www.npmjs.com/~kikinteractive https://www.npmjs.com/~kikinteractive One person in the company thought this would be cool to be on NPM, then ... the lpad story.
- bartread 1y ago
  I think this is the biggest irony of it: the kik package, which kik where so desperate to have, is basically sweet Fanny Adams. Also, Kik turn out to be negligent and pretty scummy. There was some controversy with them involving crypto, but the main thing I remember about them is that Kik is rife in terms of trading pornography, including child pornography, as discussed on this Darknet Diaries episode: https://darknetdiaries.com/episode/93/ https://darknetdiaries.com/episode/93/. So, from that point of view, I quite enjoy that Azer Koçulu told them to fuck off.
  - serf 1y ago
    >Also, Kik turn out to be negligent and pretty scummy. turns out? they threatened a pre-existing naming collision with legal action and bullied the platform first into forcing the name to be theirs, and then afterwards by crying to npm until their software tests passed again. they began scummy.
    - bartread 1y ago
      Yeah, but this also happened to a colleague of mine who created the pug templating package. It's so long ago now that I forget what it was originally called but, basically, he'd chosen a name that infringed somebody else's trademark. I'm not a trademark law expert but the thing about trademarks is they have to be defended or the holder can lose the exclusivity of the mark. So my friend sensibly caved in and changed the name of the package, got on with his life, and now it's all long forgotten history. Going back to Kik, before I knew about all the other stuff (which I only found out about when I listened to that Darknet Diaries episode last year - bit late to the party there) I simply thought they'd gone about defending their trademark in a hamfisted and douchey way that had got Azer's back up. Lawyer's gonna lawyer, and the way they did it I thought they were douchebags, but beyond that I didn't give it much consideration. There was certainly no way any of this even hinted to me that they were negligently facilitating the distribution of child porn[0]. [0] Yes, this is obviously against Kik's ToS, but ToS are only worth anything if they're enforced whereas - certainly at times prior to the Darknet Diaries episode being released in 2021 - there was at best inconsistent and ineffective enforcement of these terms. I have no insight into the current situation with Kik.
nindalf 1y ago
> I have to admit that I don't understand half of this blog post It's because you haven't read al-Ghazali yet. (definitely the most pompous and self-important part of this post)
- bartread 1y ago
  > Not driven by logic, anger... I don't know that I fully buy this either, at least not the anger part. I can look back on all this with wry amusement nowadays but I remember it being pretty frustrating at the time. It sort of felt like, well, either you knew what the impact of unpublishing all your packages would be and you did it anyway, which makes you kind of antisocial, or you didn't know what the impact would be but did it anyway, which makes you kind of a hothead. And in this latest piece Azer has admitted that he didn't understand what the impact would be so... y'know... I do wonder if anger was at least a small factor. Regardless, it's pretty clear that npm bear a lot of the responsibility for what happened. It's also something that happened a very long time ago and, as I've already implied, is just a funny story nowadays, not something I can manage any ire towards Azer over.
  - IggleSniggle 1y ago
    The 3rd option is the one Azer describes in the post: He wants to remove his stuff, but isn't sure what the right way to do it is, so he asks npm. npm provides him with a set of scripts to run to remove his stuff, and he, presuming that it's "ok" if npm told him to go ahead and run them, runs them. The impact isn't especially important to him, But since npm just gave him a set of scripts with an implicit "oh okay you want to remove your stuff, here I wrote you a script you can run to get it done," makes it more of an npm choice to handle it in this manner. npm asked him to handle it this way, so he did.
    - k__ 1y ago
      What would the alternative have looked like? If NPM would have prevented the depublishing, he would have made a scene and in the worst case, they would have looked bad. How they actually handled it, the library author got full freedom but also full responsibility
junon 1y ago
Maintainer of a few top-10 npm packages here. This makes complete sense. Somewhere along the way NPM stopped being cooperative with the community. It cemented itself with the Microsoft acquisition, but was obvious quite a bit before that. There were so many cracks with how npm functioned, they weren't cooperating well with the community / mainline Node team, their push to commercial viability was really off-putting and forced, and many of the team members had a somewhat rough reputation. Indeed I visited the offices in Oakland (if I recall correctly), and had an... interesting set of interactions there, not particularly positive, that I'll keep to myself. The unpublish hole was well known at the time. Everyone blamed left-pad for breaking the internet, as it were, but nobody seemed to come down on npm for the sheer mismanagement of it all. If memory serves they forcefully reinstated the package against the maintainer's wishes, which is a divorcement from the people they claimed to serve at best, and legally dubious at worst. Shortly after this they stopped caring much at all about abuse on their platform at all (core.js advertisement spam, anyone?) and haven't really worked with the community on standards, compatibility, etc. after that. The npm@5 release was a disaster. The introduction of package lock files couldn't have gone worse, and as I remember it it was a push to get it out alongside the next Node.js major release (I got the feeling the Node team didn't wait for npm to be ready, which I think is a good thing given npm is a for-profit, or at least acts like one). The community outreach during that time of what seemed like endless major, catastrophic bugs and the shaming of the community for putting pressure on them, the pious attitude, was only further proof that npm was no longer an agent of FOSS. I can't remember if left-pad came before or after that but in my head it was all one long drawn out declination of the ecosystem. The packages on npm are a meme now; small packages that do trivial tasks, and everyone likes to make fun of it. Maybe it wasn't the best thing, in hindsight. But context is crucial; npm was the first incredibly accessible package manager for an emergent popular technology, almost entirely community managed, with a good system for querying and tight integration with Github's "social coding" spirit. It existed very early in the Node lifetime, back before even ES5 was available (we still used `var` and `prototype`!), before JavaScript best practices really existed. Before Node.js was given to the community by Joyent. Before even the Io.js fork and the exit from the long stagnation that was Node 0.10/0.12. Nobody knew the best way to do things. I can completely understand the author. From a security perspective I'm really thankful left-pad happened, even if it wasn't the reasoning of the author; it made people acutely aware of what relying on corporate interests divested from the communities they claim to serve, bring to the table in terms of risk. It started many conversations about supply chain security, redundancy, etc. That's a hard thing to do, and it's made the industry a bit better in the long run. Good followup, neat to read this after so long.
imtringued 1y ago
Azer Koçulu has never been a scourge to the NPM ecosystem. Nobody forced anyone to use left-pad. The reason it got included in so many projects is due to messy transitive dependencies. Jon Schlinkert on the other hand is going out of his way to produce these micro libraries and then include them in his widely used legitimate projects (handlebars-helpers) with zero willingness to simply integrate them into the projects that actually use them. Here is the deal: Do you want to be trolled? Then use handlebars-helpers, if not, then stop using the damn library.
- dkersten 1y ago
  On top of that, he only ran the script that NPM themselves provided him. Yes, the micro-package situation was absurd, but Azer Koçulu did nothing wrong. NPM did by forcibly taking his package, and then by providing him with scripts that were clearly unsafe to run. That Azer Koçulu got any blame for this is ridiculous. Jon Schlinkert is a typical marketing A-hole. He should be banned from NPM and Github IMHO.
throwaway290 1y ago
NPM (well Microsoft) forcibly took guy's package to give the name to this company: https://www.bbc.com/news/uk-45568276 https://www.bbc.com/news/uk-45568276 Since then the name is basically squatted? Whether you use left-pad or not is up to you... but this Kik story is just a bad look for Microsoft all around.
- furkansahin 1y ago
  You're aware this happened way before the Microsoft acquisition right?
  - throwaway290 1y ago
    > You're aware this happened way before the Microsoft acquisition right? you phrasing implies that you would say what I said if you knew that acquisition happened later. Weird but OK. Anyway then let's just say it is a bad look for NPM and any future buyers who decided this is a worthy company
    - anonymars 1y ago
      What is weird? Your phrasing implies that this happened under the stewardship of Microsoft (and is somehow related to Microsoft policies or leadership)
      - throwaway290 1y ago
        It was implied I wrote it knowingly. If that's what you would write knowingly sure, but I think it's weird.
        anonymars 1y ago
        Okay, I understand what you are saying now. You were not aware Microsoft did not own them yet. I did not glean that from your response
majorbugger 1y ago
Why Java can have reliable utility libraries such as Apache Commons and Google Guava, but JS somehow cannot?
- deleted 1y ago
  [deleted]
- q3k 1y ago
  <snip, i got my history wrong>
  - jmillikin 1y ago
    Arguably the root problem was lack of user namespacing; the incident would have been less likely to happen in the first place if the packages in question were named "~akoculu/left-pad" and "~akoculu/kik".
    - hoppp 1y ago
      That's right and probably a lot less people would have used left-pad because it looks like a package for a specific org.
- qsort 1y ago
  In decreasing order of importance: culture, a good standard library, and tooling that pushes you to be deliberate about your dependencies rather than dumping 300 stupid packages inside every project.
- madeofpalk 1y ago
  Javascript does. lodash is/was pretty common. Most of the stuff as been absorbed into the standard library now. Lodash has had pad/padStart/padEnd since 2016, 3 months before left-pad incident. https://lodash.info/doc/pad https://lodash.info/doc/pad
- merb 1y ago
  Google guava is more like lodash than like leftpad
iLoveOncall 1y ago
> Left-pad was like a "death" and "re-birth" moment for me. The part of me passionate about open-source was dead, and something new took over. Now, I'm passionate about business, marketing, running companies / teams Wow, I couldn't think of a worse rebirth.
- tkiolp4 1y ago
  Because those things don’t align with what you value? Of course.
  - iLoveOncall 1y ago
    Yes, I think a passion about marketing can only result in net-negative for humanity. It's not that I don't value those things, it's that I think they're actively harmful (at least some of them), and that being passionate about them shows very toxic personality traits.
    - lmm 1y ago
      I agree completely, but would say the same of your username.
      - iLoveOncall 1y ago
        Check this discussion: https://news.ycombinator.com/item?id=43867827 https://news.ycombinator.com/item?id=43867827
        lmm 1y ago
        Responding to client requests can be nice, sure, but having to be available outside working hours is still awful, and that's the defining characteristic of what people usually mean by oncall.
        iLoveOncall 1y ago
heroku 1y ago
I owned the heroku user name on npm and gave it to official heroku website upon request.
- chromehearts 1y ago
  That's so cool actually! Did you ask for any compensation? Short "iconic" usernames are kinda rare
  - heroku 1y ago
    my compensation is the story I can tell people like this.
- deleted 1y ago
  [deleted]
incrudible 1y ago
It was good that this happened. Name squatting is a real problem and when in doubt, err on the side of least surprise. Not having usage statistics was a real problem. Being able to just unpublish was a real problem. Infrastructure relying on trivial 10-liners by opinionated individuals was (and still is) a real problem. Nobody in this situation is truly at fault, because nobody owes anyone anything, yet everyone can learn something from it.
lvl155 1y ago
I remember this incident and it is one of many reasons I was turned off by the entire JS ecosystem.
- tkiolp4 1y ago
  How come this is related to JS only? Like, if I own a python/rust/go/whatever public package named XYZ and later a company named XYZ forces me to release the package because of trademark issues, and I cannot do but obey, all my packages may run the same luck, so anybody relying on them would be screwed. I don’t see how the size of the package matters here.
  - another-dave 1y ago
    To your point, in JVM the convention is to package based on domain name so you don't have this type of issue. But I think the GP's point is that the cultural in other ecosystems didn't lean as heavily into "there's a package for that®" as JS does
  - vb-8448 1y ago
    I think the issue is that JS force you to have hundreds, or even thousands, dependencies. Python and other language have a richer std library and more "general purpose" packages, so the total number of dependencies is lower.
Sankozi 1y ago
Unix philosophy is "do one thing, do it well". Left-Pad forgot about the second part. For me it was surprising that so many projects used this naive implementation. Nonnaive implementation is faster and much smaller.
- shagie 1y ago
  I'm going to preface this with "I'm not sure if the culture is still there, nor do I develop JavaScript" ... so I'm writing about something I remember reading. People are after the "number of downloads" metric on npm for various reasons. Left-pad has 1.4 million weekly downloads https://www.npmjs.com/package/left-pad https://www.npmjs.com/package/left-pad Is-even has 160k weekly downloads https://www.npmjs.com/package/is-even https://www.npmjs.com/package/is-even Sometimes people will include it as a dependency as a joke in their useful library. Other times the people who write these put it in useful libraries that they contribute to so that use of the useful boosts their numbers. I'm forgetting where it is now, but it was one of the big foundational libraries in React that used one of those and there was resistance to replacing (I believe) an include and use of is-even because they were a very strict adherent to the "never write code you can include" which meant that everything using it included it. One such story: Why has there been nearly 3 million installs of is-odd - npm in the last 7 days? - https://www.reddit.com/r/programming/comments/886zji/why_has_there_been_nearly_3_million_installs_of/ https://www.reddit.com/r/programming/comments/886zji/why_has...
- efilife 1y ago
  what would that nonnaive implementation look like?
praptak 1y ago
To me it is very strange how many companies do not internally mirror every single dependency of their builds. You should be able to do a clean build fully offline (and not count on luck with the download caches).
- hu3 1y ago
  Yep. I vendor dependencies on the projects I work. Predictable, offline builds. Storage is cheap.
- 1718627440 1y ago
  Include them as git submodule and you have that for free.
deleted 1y ago
[deleted]
andruby 1y ago
Thank you for writing this akoculu. I remember the incident and what stuck me most is how, for me, this was a clear example of a community (Javascript) that depended too much on dependencies (pun somewhat intended) I don't know why so many people put so much blame on you. You unpublished a package with 11 lines of code [0]. I don't think you fully understood the frustration it would cause. And you mentioned that in the post. > NPM didn't show usage stats, and there was almost no activity on Github. As a user, it was impossible to know the impact of unpublishing packages The root cause imo isn't akoculu unpublishing the package. In my opinion that lies more in the over-reliance on dependencies, the npm policies and maybe also build systems not caching/vendoring code. [0] https://en.wikipedia.org/wiki/Npm_left-pad_incident#Background https://en.wikipedia.org/wiki/Npm_left-pad_incident#Backgrou...
jeroenhd 1y ago
I never got why people were so mad at the guy behind left-pad. The entire incident showcases the sheer lunacy behind common web frameworks, and the power and control they sacrificed for the ease of use of external dependencies. If your day is ruined because some random guy you've never heard of on the other side of the world got an angry letter from lawyers, maybe take a look at the house of cards your product is based on rather than lay down blame. left-pad will happen again. Maybe not on NPM, but on crates.io/pypi/Google's go proxy. All it takes is for a developer to join the ICC and piss of Trump and suddenly the code is impossible to find on any of the standard repositories. Even Go will have issues because despite the Github references, all the standard go traffic still goes through Google. Or even worse, someone fights back against a recent invasion and uploads a virus that wipes the drive of whatever locale they're targeting.
deleted 1y ago
[deleted]

Left-Pad (2024)

291 points by oeitho 1y ago

A closer look at the sequence of events makes it clear that the failures weren’t due to the package author. He fulfilled his responsibilities as a author.

asdoi 1y ago

[flagged]

junon 1y ago
Not really. Please don't flagrantly disregard the author. That tone solves nothing.

deleted 1y ago

[deleted]

skrebbel 1y ago

I have to admit that I don't understand half of this blog post, feels like I'm missing some context, but I do like that the "left pad guy" does a post mortem. That said, this seems like a weird argument to me: > but I still don't understand why NPM didn't take the time to find out if any of my modules were widely used and consider ways to handle the unpublishing without breaking anything Sure, NPM's unpublish mechanism was a misdesign, but is he saying that he expected people at the company to manually go through this every time someone did an unpublish? That doesn't seem too reasonable IMO, NPM the company isn't curating NPM the registry. They host it as a public service. I can't fault the author all too much here though, if he hadn't triggered "the left-pad incident" then someone else would've not too long after. NPM fixed the problem, by means of a better unpublish policy [0] and that's that. [0] https://docs.npmjs.com/policies/unpublish#packages-published-more-than-72-hours-ago https://docs.npmjs.com/policies/unpublish#packages-published...

nicou 1y ago
For context, see https://en.wikipedia.org/wiki/Npm_left-pad_incident https://en.wikipedia.org/wiki/Npm_left-pad_incident
- HPsquared 1y ago
  11 lines of code! Wow. I had no idea it was that small.
  - rootlocus 1y ago
    > Most of my open source work followed Unix philosophy, so the packages did one thing at a time. There was 350+ of them. The man page for a unix binary is at least two orders of magnitude larger. At some point, the "Unix philosophy" doesn't make sense anymore. I mean, it couldn't even rightpad.
    - baobabKoodaa 1y ago
      packages like `left-pad` should really be named more like `resume-pad` oh look at me, 589 published packages on npm! with 5 700 quadripillion weekly installs!
    - another-dave 1y ago
      When the metadata for the package is larger than the source code you've probably gone too small!
  - ThinkBeat 1y ago
    oh there are thousands of those out there on npm. Short and trivial code. Even if you do not use them at all in your own codebase chances are quite high that some package you do use, uses some of those tiny packages.
  - xnorswap 1y ago
    There used to be the general wisdom of, "Don't re-invent the wheel. Let the hive-mind craft utility functions and use those because they'll be battle-hardened, well tested, and you can focus on your core business". I think the left-pad incident helped shatter that myth. He we had huge packages depending on a package which padded a string in an inefficient manner. It turns out that the many eyeballs of the bazaar had averted their gaze from what was actually happening, which is a system of impossible to audit dependency chains. I think it also shows the impact of using a language with a poor standard library. Padding is absolutely something that should be available as an extension over String. If JavaScript were controlled in the same manner that Go, Rust, Java, .NET, python etc, then it would have been added years ago. Apparently it has now finally arrived in ES2026: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/padStart https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

_thisdot 1y ago

Relevant discussion from the time left-pad incident happened - https://news.ycombinator.com/item?id=11349870 https://news.ycombinator.com/item?id=11349870

arturocamembert 1y ago

left-pad even being a package is pretty funny, no? How many bytes got pumped across CDNs, proxies, build pipelines, etc. just to write a tiny utility function? I'm all for taking advantage of existing solutions, but I can't wrap my head around needing to pad a string and thinking "oh, I bet there's a package for that"

codegladiator 1y ago
maximum code reuse flex, copy-paste is for losers.
wiseowise 1y ago
Muh Unix way.
arcastroe 1y ago
The package's original implementation[1] also seems like it would have resulted in O(n^2) operation rather than desired O(n). [1] https://en.wikipedia.org/wiki/Npm_left-pad_incident https://en.wikipedia.org/wiki/Npm_left-pad_incident
- hhjinks 1y ago
  I don't see where the quadratic time complexity comes from. There's a single loop performing n operations in total, ie. O(n).
  - barbegal 1y ago
    In each loop prepending a single character could take O(m) (moving all m characters one to the right) so combined O(nm) where n is the number of padding characters and m is the total number of characters in the string.
    - lifthrasiir 1y ago
      Only when the underlying JS implementation does this naively. In reality JS implementations do a lot of optimizations which often can reduce the time complexity.

lloydatkinson 1y ago

> On the NPM side, I observed general condescending attitude towards developers, which led them make series of unreasonable decisions and ultimately blame me for all the cost. NPM has not really learned much in the time since this event either.

aa-jv 1y ago

As someone who avoids javascript and its attendant ecosystem like its the Visual Basic plague of the 21st Century, the most interesting aspect of this whole story is the fact that Koçulu disconnected from the tech scene for some time, did some amazing hiking and camping and trail discovery, and now .. 8 years later .. still feels compelled to explain himself. Technology is a fickle muse. We nerds obsess over her and degrade ourselves in her service, but she always calls us back into the light. As someone who was around for the Morris worm and spent weeks negating its impact, I feel that there is a fundamental issue impacting our ability to make world-changing technology with the current tools. The less we strive to understand the organizational (ethical) failings of technology, the less technology can be used to effect productive change in the realms it is being applied. That said, I'm about a month (and a few hundred failed compiles) away from taking my own sabbatical, and I can't help but try to reason what things would be like for me, upon my return after some years, in the technological space I've carved out for my own needs, at much different scales and contexts. Perhaps it should become somewhat standard for us technologists to take sabbaticals, more often, and more seriously, in order to give us the context we need to understand the ethical dilemma that impinges upon our technological prowess. Koçulu, thank you for your thoughts. I may never be effected by the javascript world, but the lessons it provides from within the temple nevertheless reverberate among the outer chambers ..

shellac 1y ago

It's a minor thing, but: > Most of my open source work followed Unix philosophy, so the packages did one thing at a time. Nobody has suggested that libc -- to take the most obvious example -- is against the Unix philosophy. Debates occur around whether whether commands / daemons do too much (recent poster child being systemd) or aren't composable.

0xAFFFF 1y ago
If anything, the left-pad debacle has shown that NPM package granularity has gone way too small, at a point where package overhead was outweighing the package simplicity benefits.
- whostolemyhat 1y ago
  Left-pad was made at a time when tree-shaking wasn't really around, so it was good practice to only include the functions you needed to avoid making websites too heavy. If you just needed a small function then it'd be silly to include a huge utility library like Underscore.
  - yurishimo 1y ago
    You're missing the point. Nobody with a serious background in software development should ever need to pull in a package to pad a string or check if a number is even or odd. If someone is smart enough to use a package manager, they should be more than capable to write a function to pad a string (assuming the standard library doesn't include one already)!
    - baobabKoodaa 1y ago
      While you are correct, the problem compounds when popular package developers choose to use tiny packages. I don't need left-pad. But maybe I need react-starter-kit. Now, imagine that react-starter-kit has a dependency to markdown-js-blobber, which has a dependency to make-text-nice, which has a dependency to left-pad. In this scenario I am now "pulling in a package to pad a string". If I am "smart enough to use a package manager", I should be "more than capable to write..." an alternative to react-starter-kit..?

pstadler 1y ago

The version history of the kik package[0] is odd. It has been replaced with a security holding package nine years ago[1]. [0] https://www.npmjs.com/package/kik?activeTab=versions https://www.npmjs.com/package/kik?activeTab=versions

manuhabitela 1y ago
haha, so, all of this for… nothing in the end?
- Bengalilol 1y ago
  The kik user page almost says it all. https://www.npmjs.com/~kikinteractive https://www.npmjs.com/~kikinteractive One person in the company thought this would be cool to be on NPM, then ... the lpad story.
bartread 1y ago
I think this is the biggest irony of it: the kik package, which kik where so desperate to have, is basically sweet Fanny Adams. Also, Kik turn out to be negligent and pretty scummy. There was some controversy with them involving crypto, but the main thing I remember about them is that Kik is rife in terms of trading pornography, including child pornography, as discussed on this Darknet Diaries episode: https://darknetdiaries.com/episode/93/ https://darknetdiaries.com/episode/93/. So, from that point of view, I quite enjoy that Azer Koçulu told them to fuck off.
- serf 1y ago
  >Also, Kik turn out to be negligent and pretty scummy. turns out? they threatened a pre-existing naming collision with legal action and bullied the platform first into forcing the name to be theirs, and then afterwards by crying to npm until their software tests passed again. they began scummy.
  - bartread 1y ago
    Yeah, but this also happened to a colleague of mine who created the pug templating package. It's so long ago now that I forget what it was originally called but, basically, he'd chosen a name that infringed somebody else's trademark. I'm not a trademark law expert but the thing about trademarks is they have to be defended or the holder can lose the exclusivity of the mark. So my friend sensibly caved in and changed the name of the package, got on with his life, and now it's all long forgotten history. Going back to Kik, before I knew about all the other stuff (which I only found out about when I listened to that Darknet Diaries episode last year - bit late to the party there) I simply thought they'd gone about defending their trademark in a hamfisted and douchey way that had got Azer's back up. Lawyer's gonna lawyer, and the way they did it I thought they were douchebags, but beyond that I didn't give it much consideration. There was certainly no way any of this even hinted to me that they were negligently facilitating the distribution of child porn[0]. [0] Yes, this is obviously against Kik's ToS, but ToS are only worth anything if they're enforced whereas - certainly at times prior to the Darknet Diaries episode being released in 2021 - there was at best inconsistent and ineffective enforcement of these terms. I have no insight into the current situation with Kik.

nindalf 1y ago

> I have to admit that I don't understand half of this blog post It's because you haven't read al-Ghazali yet. (definitely the most pompous and self-important part of this post)

bartread 1y ago
> Not driven by logic, anger... I don't know that I fully buy this either, at least not the anger part. I can look back on all this with wry amusement nowadays but I remember it being pretty frustrating at the time. It sort of felt like, well, either you knew what the impact of unpublishing all your packages would be and you did it anyway, which makes you kind of antisocial, or you didn't know what the impact would be but did it anyway, which makes you kind of a hothead. And in this latest piece Azer has admitted that he didn't understand what the impact would be so... y'know... I do wonder if anger was at least a small factor. Regardless, it's pretty clear that npm bear a lot of the responsibility for what happened. It's also something that happened a very long time ago and, as I've already implied, is just a funny story nowadays, not something I can manage any ire towards Azer over.
- IggleSniggle 1y ago
  The 3rd option is the one Azer describes in the post: He wants to remove his stuff, but isn't sure what the right way to do it is, so he asks npm. npm provides him with a set of scripts to run to remove his stuff, and he, presuming that it's "ok" if npm told him to go ahead and run them, runs them. The impact isn't especially important to him, But since npm just gave him a set of scripts with an implicit "oh okay you want to remove your stuff, here I wrote you a script you can run to get it done," makes it more of an npm choice to handle it in this manner. npm asked him to handle it this way, so he did.
  - k__ 1y ago
    What would the alternative have looked like? If NPM would have prevented the depublishing, he would have made a scene and in the worst case, they would have looked bad. How they actually handled it, the library author got full freedom but also full responsibility

junon 1y ago

Maintainer of a few top-10 npm packages here. This makes complete sense. Somewhere along the way NPM stopped being cooperative with the community. It cemented itself with the Microsoft acquisition, but was obvious quite a bit before that. There were so many cracks with how npm functioned, they weren't cooperating well with the community / mainline Node team, their push to commercial viability was really off-putting and forced, and many of the team members had a somewhat rough reputation. Indeed I visited the offices in Oakland (if I recall correctly), and had an... interesting set of interactions there, not particularly positive, that I'll keep to myself. The unpublish hole was well known at the time. Everyone blamed left-pad for breaking the internet, as it were, but nobody seemed to come down on npm for the sheer mismanagement of it all. If memory serves they forcefully reinstated the package against the maintainer's wishes, which is a divorcement from the people they claimed to serve at best, and legally dubious at worst. Shortly after this they stopped caring much at all about abuse on their platform at all (core.js advertisement spam, anyone?) and haven't really worked with the community on standards, compatibility, etc. after that. The npm@5 release was a disaster. The introduction of package lock files couldn't have gone worse, and as I remember it it was a push to get it out alongside the next Node.js major release (I got the feeling the Node team didn't wait for npm to be ready, which I think is a good thing given npm is a for-profit, or at least acts like one). The community outreach during that time of what seemed like endless major, catastrophic bugs and the shaming of the community for putting pressure on them, the pious attitude, was only further proof that npm was no longer an agent of FOSS. I can't remember if left-pad came before or after that but in my head it was all one long drawn out declination of the ecosystem. The packages on npm are a meme now; small packages that do trivial tasks, and everyone likes to make fun of it. Maybe it wasn't the best thing, in hindsight. But context is crucial; npm was the first incredibly accessible package manager for an emergent popular technology, almost entirely community managed, with a good system for querying and tight integration with Github's "social coding" spirit. It existed very early in the Node lifetime, back before even ES5 was available (we still used `var` and `prototype`!), before JavaScript best practices really existed. Before Node.js was given to the community by Joyent. Before even the Io.js fork and the exit from the long stagnation that was Node 0.10/0.12. Nobody knew the best way to do things. I can completely understand the author. From a security perspective I'm really thankful left-pad happened, even if it wasn't the reasoning of the author; it made people acutely aware of what relying on corporate interests divested from the communities they claim to serve, bring to the table in terms of risk. It started many conversations about supply chain security, redundancy, etc. That's a hard thing to do, and it's made the industry a bit better in the long run. Good followup, neat to read this after so long.

imtringued 1y ago

Azer Koçulu has never been a scourge to the NPM ecosystem. Nobody forced anyone to use left-pad. The reason it got included in so many projects is due to messy transitive dependencies. Jon Schlinkert on the other hand is going out of his way to produce these micro libraries and then include them in his widely used legitimate projects (handlebars-helpers) with zero willingness to simply integrate them into the projects that actually use them. Here is the deal: Do you want to be trolled? Then use handlebars-helpers, if not, then stop using the damn library.

dkersten 1y ago
On top of that, he only ran the script that NPM themselves provided him. Yes, the micro-package situation was absurd, but Azer Koçulu did nothing wrong. NPM did by forcibly taking his package, and then by providing him with scripts that were clearly unsafe to run. That Azer Koçulu got any blame for this is ridiculous. Jon Schlinkert is a typical marketing A-hole. He should be banned from NPM and Github IMHO.

throwaway290 1y ago

NPM (well Microsoft) forcibly took guy's package to give the name to this company: https://www.bbc.com/news/uk-45568276 https://www.bbc.com/news/uk-45568276 Since then the name is basically squatted? Whether you use left-pad or not is up to you... but this Kik story is just a bad look for Microsoft all around.

furkansahin 1y ago
You're aware this happened way before the Microsoft acquisition right?
- throwaway290 1y ago
  > You're aware this happened way before the Microsoft acquisition right? you phrasing implies that you would say what I said if you knew that acquisition happened later. Weird but OK. Anyway then let's just say it is a bad look for NPM and any future buyers who decided this is a worthy company
  - anonymars 1y ago
    What is weird? Your phrasing implies that this happened under the stewardship of Microsoft (and is somehow related to Microsoft policies or leadership)
    - throwaway290 1y ago
      It was implied I wrote it knowingly. If that's what you would write knowingly sure, but I think it's weird.
      - anonymars 1y ago
        Okay, I understand what you are saying now. You were not aware Microsoft did not own them yet. I did not glean that from your response

majorbugger 1y ago

Why Java can have reliable utility libraries such as Apache Commons and Google Guava, but JS somehow cannot?

deleted 1y ago
[deleted]
q3k 1y ago
<snip, i got my history wrong>
- jmillikin 1y ago
  Arguably the root problem was lack of user namespacing; the incident would have been less likely to happen in the first place if the packages in question were named "~akoculu/left-pad" and "~akoculu/kik".
  - hoppp 1y ago
    That's right and probably a lot less people would have used left-pad because it looks like a package for a specific org.
qsort 1y ago
In decreasing order of importance: culture, a good standard library, and tooling that pushes you to be deliberate about your dependencies rather than dumping 300 stupid packages inside every project.
madeofpalk 1y ago
Javascript does. lodash is/was pretty common. Most of the stuff as been absorbed into the standard library now. Lodash has had pad/padStart/padEnd since 2016, 3 months before left-pad incident. https://lodash.info/doc/pad https://lodash.info/doc/pad
merb 1y ago
Google guava is more like lodash than like leftpad

iLoveOncall 1y ago

> Left-pad was like a "death" and "re-birth" moment for me. The part of me passionate about open-source was dead, and something new took over. Now, I'm passionate about business, marketing, running companies / teams Wow, I couldn't think of a worse rebirth.

tkiolp4 1y ago
Because those things don’t align with what you value? Of course.
- iLoveOncall 1y ago
  Yes, I think a passion about marketing can only result in net-negative for humanity. It's not that I don't value those things, it's that I think they're actively harmful (at least some of them), and that being passionate about them shows very toxic personality traits.
  - lmm 1y ago
    I agree completely, but would say the same of your username.
    - iLoveOncall 1y ago
      Check this discussion: https://news.ycombinator.com/item?id=43867827 https://news.ycombinator.com/item?id=43867827
      - lmm 1y ago
        Responding to client requests can be nice, sure, but having to be available outside working hours is still awful, and that's the defining characteristic of what people usually mean by oncall.
        iLoveOncall 1y ago

heroku 1y ago

I owned the heroku user name on npm and gave it to official heroku website upon request.

chromehearts 1y ago
That's so cool actually! Did you ask for any compensation? Short "iconic" usernames are kinda rare
- heroku 1y ago
  my compensation is the story I can tell people like this.
deleted 1y ago
[deleted]

incrudible 1y ago

It was good that this happened. Name squatting is a real problem and when in doubt, err on the side of least surprise. Not having usage statistics was a real problem. Being able to just unpublish was a real problem. Infrastructure relying on trivial 10-liners by opinionated individuals was (and still is) a real problem. Nobody in this situation is truly at fault, because nobody owes anyone anything, yet everyone can learn something from it.

lvl155 1y ago

I remember this incident and it is one of many reasons I was turned off by the entire JS ecosystem.

tkiolp4 1y ago
How come this is related to JS only? Like, if I own a python/rust/go/whatever public package named XYZ and later a company named XYZ forces me to release the package because of trademark issues, and I cannot do but obey, all my packages may run the same luck, so anybody relying on them would be screwed. I don’t see how the size of the package matters here.
- another-dave 1y ago
  To your point, in JVM the convention is to package based on domain name so you don't have this type of issue. But I think the GP's point is that the cultural in other ecosystems didn't lean as heavily into "there's a package for that®" as JS does
- vb-8448 1y ago
  I think the issue is that JS force you to have hundreds, or even thousands, dependencies. Python and other language have a richer std library and more "general purpose" packages, so the total number of dependencies is lower.

Sankozi 1y ago

Unix philosophy is "do one thing, do it well". Left-Pad forgot about the second part. For me it was surprising that so many projects used this naive implementation. Nonnaive implementation is faster and much smaller.

shagie 1y ago
I'm going to preface this with "I'm not sure if the culture is still there, nor do I develop JavaScript" ... so I'm writing about something I remember reading. People are after the "number of downloads" metric on npm for various reasons. Left-pad has 1.4 million weekly downloads https://www.npmjs.com/package/left-pad https://www.npmjs.com/package/left-pad Is-even has 160k weekly downloads https://www.npmjs.com/package/is-even https://www.npmjs.com/package/is-even Sometimes people will include it as a dependency as a joke in their useful library. Other times the people who write these put it in useful libraries that they contribute to so that use of the useful boosts their numbers. I'm forgetting where it is now, but it was one of the big foundational libraries in React that used one of those and there was resistance to replacing (I believe) an include and use of is-even because they were a very strict adherent to the "never write code you can include" which meant that everything using it included it. One such story: Why has there been nearly 3 million installs of is-odd - npm in the last 7 days? - https://www.reddit.com/r/programming/comments/886zji/why_has_there_been_nearly_3_million_installs_of/ https://www.reddit.com/r/programming/comments/886zji/why_has...
efilife 1y ago
what would that nonnaive implementation look like?

praptak 1y ago

To me it is very strange how many companies do not internally mirror every single dependency of their builds. You should be able to do a clean build fully offline (and not count on luck with the download caches).

hu3 1y ago
Yep. I vendor dependencies on the projects I work. Predictable, offline builds. Storage is cheap.
1718627440 1y ago
Include them as git submodule and you have that for free.

deleted 1y ago

[deleted]

andruby 1y ago

Thank you for writing this akoculu. I remember the incident and what stuck me most is how, for me, this was a clear example of a community (Javascript) that depended too much on dependencies (pun somewhat intended) I don't know why so many people put so much blame on you. You unpublished a package with 11 lines of code [0]. I don't think you fully understood the frustration it would cause. And you mentioned that in the post. > NPM didn't show usage stats, and there was almost no activity on Github. As a user, it was impossible to know the impact of unpublishing packages The root cause imo isn't akoculu unpublishing the package. In my opinion that lies more in the over-reliance on dependencies, the npm policies and maybe also build systems not caching/vendoring code. [0] https://en.wikipedia.org/wiki/Npm_left-pad_incident#Background https://en.wikipedia.org/wiki/Npm_left-pad_incident#Backgrou...

jeroenhd 1y ago

I never got why people were so mad at the guy behind left-pad. The entire incident showcases the sheer lunacy behind common web frameworks, and the power and control they sacrificed for the ease of use of external dependencies. If your day is ruined because some random guy you've never heard of on the other side of the world got an angry letter from lawyers, maybe take a look at the house of cards your product is based on rather than lay down blame. left-pad will happen again. Maybe not on NPM, but on crates.io/pypi/Google's go proxy. All it takes is for a developer to join the ICC and piss of Trump and suddenly the code is impossible to find on any of the standard repositories. Even Go will have issues because despite the Github references, all the standard go traffic still goes through Google. Or even worse, someone fights back against a recent invasion and uploads a virus that wipes the drive of whatever locale they're targeting.

deleted 1y ago

[deleted]