The Dangers of Using Code You Don't Control

package-management.markdown

The Dangers of Using Code You Don't Control

The Events

What happened

The Drama

The Developer's Take

Kik's Side of Things

NPM's Take

The Reaction Blog Post With Some Good Points And An Aggressive Title Published After Any Major Tech Event

What Are We Even Talking About

What is NPM

A Tutorial on Using NPM

---

Checks for Understanding

Fork this Gist and Respond to the Following Questions

• In broad strokes, summarize the event
  A messaging company Kik wants to create a package on NPM called Kik. But Azer, a prolific NPM user, already had a package of that name. Kik company messages Azer, asking him to change the name of his package, while also suggesting they have the law on their side seeing as the name 'Kik' is trademarked. Azer thinks it is BS. Eventually NPM admins get involved and tell Azer to change the name of his package, at which point Azer unpublishes the 'Kik' package alone with every other package he has made on NPM.

Turns out, a LOT of other projects relied on Azer's NPM packages in theirs, and 1000s of projects promptly start failing all t once. Eventually NPM republishes the most used of these packages, left-pad.

• How do NPM and RubyGems relate?
  NPM is basically a massive online warehouse for opensource JavaScript packages. These JS packages are much like Ruby Gems. So I suppose the analogy is NPMjs.com ~ RubyGems.org, and JS package ~ Ruby Gem.
• What is left-pad and why is it used?
  It contains a single function which is used for padding a string with a character on the left. It is used so often mostly because so many packages are requiring other packages which happen to require 'left-pad'.

Observing

• Go through some past projects you've worked on and look through the gemfiles.
• Pick three gems - try to pick a combination of obscure gems and ones you use on every project
• List them with links to their Github repos here
  • Gem 1 vcr
  • Gem 2 rails
  • Gem 3 classifier
• For each Gem, answer the following questions
  • What does this Gem generally do?
    • 1: VCR is used to record responses from external http requests. It is typically used in a test suite to limit the number of external API calls being made.
    • 2: Rails is an entire framework for building a web application.
    • 3: Classifier is a gem containing a pair of machine learning functions: a Bayesian classifier implementation, and a late semantic indexer.
  • When is the date of the last commit?
    • 1: VCR: Mar 17, 2016
    • 2: Rails: Mar 24, 2016
    • 3: Classifier: Jan 7, 2014
  • How many open issues does it have?
    • 1: VCR: 43
    • 2: Rails: 417
    • 3: Classifier: 11
  • Start looking around the source code
    • Link to one piece of code or a file you understand Classifier: Training Method
      • What does this code do?
        This code is what actually trains the classifier given the categories on initialization.
    • Link to one piece of code or a file you don't understand at all? Rails: Active Record Associations
      • What do you think this code might do?
        Probably implementing stuff like belongs_to and has_many.
  • Does it seem reasonable to add this dependency into your code?
    Absolutely! I'd have no idea how to do that myself.
• What are some factors you consider when adding dependencies to your projects?
  Can I do it better myself without taking too much time? Rails and VCR are absolute NO's, Classifier is a maybe, but would definitely take a fair bit of time.

Challenge Level Understanding (OPTIONAL but cool)

Building

• Read through these two walkthroughs
  • A Walk Through to Create an NPM module
  • A Walk Through to Create a Ruby Gem
• Create your own npm package or ruby gem that does something silly. Some examples:
  • Pat Wey's We Work Remotely Gem
  • My Curl-Breaker NPM package - made as part of an engineering lunch hackathon... judge my terrible code. JUDGE IT.
• Link to your work below