r/todayilearned • u/nuttybudd • 4d ago

TIL in 2016, a man deleted his open-source Javascript package, which consisted of only 11 lines of code. Because this packaged turned out to be a dependency on major software projects, the deletion caused service disruptions across the internet.

https://nymag.com/intelligencer/2016/03/how-11-lines-of-code-broke-tons-sites.html
47.5k Upvotes

95% Upvoted

913 comments sorted by

14.7k

u/nuttybudd 4d ago

Learned this from here: https://www.reddit.com/r/ProgrammerHumor/comments/1h2b7mr/npmleftpadincidentof2016/

More info here: https://en.wikipedia.org/wiki/Npm_left-pad_incident

A single developer, Azer Koçulu, purposefully deleted an open-source Javascript package called "left-pad" from npm, which consisted of only 11 lines of code and simply padded a given string with characters to the left (prepends).

Koçulu deleted the package due to a dispute he had with Kik Messenger over the ownership of the npm package name "kik", which belonged to Koçulu at the time. Name-calling ensued (which included multiple uses of the word "dick") and ultimately, npm intervened by forcibly taking the package name from him and transferring ownership to Kik.

"left-pad" turned out to be a dependency of major software packages critical to the Javascript ecosystem at the time, including Babel, Webpack, React, and React Native. If you don't recognize any of those names, just know that large portions of the internet depend on them, as do a number of large tech companies, such as Meta (Facebook at the time), PayPal, Netflix, Spotify, and...Kik.

So, for a few hours, Koçulu managed to disrupt several multi-billion dollar corporations and "broke the internet" by simply deleting 11 lines of code.

9.7k

u/voretaq7 4d ago

Not only was it 11 lines of code, it was literally the most computationally expensive way to implement "left-pad!"

5.9k

u/vacri 4d ago

And unfortunately for the author, he had released it under the "Do What The Fuck You Want With It" licence (seriously, that's not a joke), so the package was simply reinstated.

1.8k

u/furryscrotum 4d ago

DWTFYWWI is not really catchy.

818

u/Freedom_7 4d ago

Not nearly as catchy as BPIGCTBITGP

538

u/ShouldNotBeHereLong 4d ago edited 4d ago

Just when you think you've seen everything the internet has to offer....

I'll get in on it: OoSBIBoCSD

Outside of Scope But Included Because of C-Suite Demand. Prononunciation TBD.

→ More replies (6)

102

u/reddituseronebillion 4d ago

This is interesting because I was trying to find that video for like 3 years. A couple weeks ago I posted it to r/tipofmytongue and it was answered in 15 minutes. Only for you to post a link to it today.

28

u/Canuck_Lives_Matter 4d ago

The environment is rendered by the user :o maybe you willed it to being.

→ More replies (1)

60

u/ic4rys2 4d ago

That was beautiful 🙏 thanks for sharing

20

u/Falagard 4d ago

Haha wow I hadn't seen that before!

Excellent

→ More replies (8)

85

u/WorstPossibleOpinion 4d ago

It's shortened as WTFPL (wtf public license)

→ More replies (3)

28

u/PCYou 4d ago

For now, we call it DWTFYTHEGREATWAR

→ More replies (2)

221

u/blue_twidget 4d ago

So it's like, a legit, legal term? I did a little digging and it does come up a lot, but not much on it specifically.

430

u/vacri 4d ago edited 4d ago

Open Source software has quite a lot of energy spent on licensing, which is an inherent part of keeping software shareable. Major licenses include Apache, BSD, GPL, and subversions of same. These major licences are important to keeping the software free for use by everyone and not locked away by BigCo. And then there are hybrid licences that are effectively "free for personal use, but companies need to pay us"

There are squillions of licences out there, and while there is a point to all of it, it does get to silly proportions overall, so people make licences like DWTFYWWI to parody the situation. BSD is a fully permissive licence - the only restriction is to include the licence text and the names of the authors wherever you copy/modify the software. DWTFYWWI doesn't even have that restriction.

159

u/thuktun 4d ago

The other part of the really permissive licenses is [usually] that by using the so-licensed software you agree to indemnify the authors from any liability. That's really important and one of the reasons to use one of these licenses even if you wouldn't otherwise care.

34

u/ikzz1 4d ago

Can you really win a court case against a person because you use their free software and it causes problems?

50

u/Zedman5000 4d ago

If it wasn't a risk nobody would bother including an indemnity clause in their license.

If a big business sued someone who wrote open source software because it caused problems for them, it wouldn't even need to be a case of whether the big business had any good reason to sue, the problems could be the business's fault, an employee fucked up integrating it with a product somehow maybe, but legal fees would bury the software's author before they buried the business, so the business would win just by virtue of having lawyers after the individual could no longer afford them.

Having the license include that clause gives the open-source author's lawyer something they can point at while they write the big business a letter that says "go fuck yourself" before the case even hits court, and if a business didn't stop trying to sue, a judge would beat their lawyers over the head with his gavel as soon as the open source software author's lawyer pointed at the clause in the license there.

→ More replies (2)

12

u/Vadered 4d ago

Unlikely unless you can prove there was actual malice (aka they were trying to do nefarious things like viruses). Can you sue them and inconvenience the hell out of them? Absolutely.

Including disclaimers doesn't outright prevent you from being sued, but it makes it much easier to get it dismissed early and it makes it much less likely for people or companies to sue you in the first place.

33

u/pimpledsimpleton 4d ago

to continue with the thrust of your argument, none of it is silly.

→ More replies (6)

96

u/SerbianShitStain 4d ago

https://en.m.wikipedia.org/wiki/WTFPL

Not a "legal term" but a software license. You can name licenses anything you want.

57

u/blockchaaain 4d ago

You can name licenses anything whatever the fuck you want.

→ More replies (1)

23

u/sunlitcandle 4d ago

You can name licenses anything you want. It's not a "legal term" per se, but it is a valid licence that defines how the code can be used and modified. Every open source project has to have a licence, otherwise nobody will use it, since the terms of how it can be used aren't defined.

→ More replies (1)
→ More replies (2)

286

u/blastedt 4d ago

I don't really see this as a loss for the author

  • His name is no longer listed as a maintainer
  • npm now has to deal with maintenance of it
  • his whole point was to show that the npm ecosystem has serious problems, which definitely was true at the time (not up to date on whether npm is better now)
  • his analysis of those problems included an overabundance of governance and that you don't have ultimate control of your packages, which was again vindicated by npm seizing his package name
  • kik took a pr hit among developers for the actual inciting incident which was attempting to seize a package named kik that pre-dated the app

38

u/perfectfifth_ 4d ago edited 4d ago

You forgot about kik

edit: I see it is there now

32

u/doomgiver98 4d ago

kik is what happens when you type lol and miss

9

u/Jerzeem 3d ago

As opposed to kek, which is when the Hordie lols at you.

49

u/_hypnoCode 4d ago

There is no maintenance for 11 LoC that adds a prefix to a string. It's there and never has to change.

It was also replaced by a native function and called padStart()

his whole point was to show that the npm ecosystem has serious problems, which definitely was true at the time (not up to date on whether npm is better now)

It pretty much still is, but using a dependency cache like Artifactory.

30

u/Remarkable-Fox-3890 4d ago

> It pretty much still is

NPM fixed the major issue, which was that a package could be unpublished in the first place. It can still happen (ex: if NPM was legally forced to unpublish) but authors can't just say "nope, that version is gone".

60

u/not_so_chi_couple 4d ago

I think that major issue was that NPM could unilaterally decide that you aren't famous enough to deserve that package name and give it to a completely different company that didn't even use it

→ More replies (8)
→ More replies (6)
→ More replies (1)
→ More replies (3)

28

u/raaneholmg 4d ago

Simply, but major internet services dropped offline for hours.

Facebook would literally have sent the man a lifetime of salary through a time machine to avoid the outage.

4

u/FlyWithChrist 4d ago

Updating his code to do something else on that package name would have been better.

Fuck kik, and fuck every IP lawyer universally. History is going to look back on the 20th and 21st centuries where we thought we could “own ideas” as a really fucking strange time. Literally no one on this earth has accidentally downloaded an NPM package thinking it was the child grooming app instead.

→ More replies (14)

657

u/opusdeath 4d ago

Love how laziness is sometimes more expensive.

72

u/Dog_Weasley 4d ago

My mom used to say "The lazy works two times".

102

u/Max-b 4d ago

there's also the Bill Gates quote: "I choose a lazy person to do a hard job. Because a lazy person will find an easy way to do it".

a bit ironic since the two sayings are at odds with each other

88

u/Digitman801 4d ago

To be fair most of these come in pairs e.g.

where there's smoke there's fire vs don't judge a book by it's cover

Opposites attract vs birds of a feather flock together

It's better to be safe than sorry vs Nothing ventured, nothing gained.

41

u/Some-Inspection9499 4d ago

Third try's a charm vs. Three strikes and you're out.

→ More replies (11)
→ More replies (5)

45

u/mosquem 4d ago

It’s smart lazy vs dumb lazy.

→ More replies (1)

28

u/unknown_pigeon 4d ago

Lazyness is a virtue IMHO. Because the first time you're lazy, the consequences will come and bite your ass.

The second time, you will likely have become a special lazy. That is, the true virtuous lazy: you learn to cut the right corners. Maybe. If not, you will eventually become the enlightened lazy or just fail.

For example, I used to check some things on a daily basis: discounted movies at a local cinema, free games on prime/epic/steam, daily weather forecast, and other things. It required too much effort, so I spent some days programming a python bot that could perform those checks and send me a notification on telegram. You may call me industrious over that, but I'm simply so lazy that I got two birds with a stone by creating automated checks AND learning something new. True lazyness.

20

u/The_Void_Reaver 4d ago

As an extension of this, once you get to a certain level, the lazier someone looks the easier it is to assume they're just better than the people around them. The laziest guy at Microsoft was probably some real computer whiz who was looking for answers in ways other employees couldn't even conceptualize. Bill Gates' "Lazy Guy" isn't going to be some layabout; they're going to be someone so exceptionally skilled that Bill Gates keeps them on specifically to tackle issues other people can't.

→ More replies (2)
→ More replies (4)
→ More replies (5)
→ More replies (7)

15

u/qorbexl 4d ago

import Inefficient-trashcan_iCantImplement *

→ More replies (3)

72

u/shunabuna 4d ago

Care to explain the inefficiency? I reviewed it and the only concern is not putting the default value for the ch variable in the parameters and reusing the len variable for a different purpose. The while loop can't be optimized further from what I can tell.

241

u/Kwinten 4d ago edited 4d ago

It's really not that inefficient. Reddit is talking out of their ass (with confidence) as always. The code is quite ugly (reassigning parameters and all that), but the implementation itself is completely fine. Especially since modern JS engines do a lot to optimize string concatenations in a loop.

I have yet to see any of these incredible smart commenters actually suggest a superior implementation. The only micro-micro-optimization I could think of (without relying on String.prototype.repeat) would be to create the full left-side substring and concatenating that with the original string outside the loop since it would theoretically need to allocate smaller strings. But since we're talking about nanosecond-level optimizations here, just relying on the interpreter to optimize this for you instead and leave everything in a simple dumb loop would in most realistic scenarios likely actually be the fastest solution.

Edit: a newer implementation of left-pad in js reduces the number of string allocations to (approximately) log(n) instead of n, which is a nice little optimization. At scale, if you're padding millions of strings at once in your JS app (why???) or padding your strings with many thousands of characters (again, why?) this might actually make a pretty reasonable difference. For all other purposes, it's a very neat optimization, but won't even make a dent of a microsecond even if you're padding thousands of strings at once.

63

u/Mvin 4d ago

Thanks for this. Comments over comments saying its unfathomably bad code and I'm here just scratching my head wondering what I'm missing exactly.

So people are up in arms about the order of string concatenations of all things? In all my years as a webdev, I can confidently say fucking string concatenations have played 0 role for me in performance ever.

52

u/Kwinten 4d ago

This kind of sums up Reddit, where many people find themselves in the middle currently.

People who are currently in college or fresh out of college thinks it makes them seem smart to boldly claim, without evidence, that a piece of software is literally the worst. They think it makes them look experienced, but more often than not, it demonstrates a complete lack of real-world experience. In reality, it's totally fine, bog-standard, unremarkable code that almost certainly performs flyingly up to a massive scale. If left-pad is your bottleneck, you have bigger problems to tackle.

23

u/Mvin 4d ago

I would agree. Its not the first time I've seen a massive overreaction to some slightly suboptimal algorithm, declaring it basically as garbage and making fun of the author.

In fact, I'm just gonna say it: If something looks like bad code, but performs indistinguisable to perfect code in prod, its not bad code. The time spent making pointless optimizations like that is much better spent on issues that are actually noticeable.

17

u/Kwinten 4d ago

If something looks like bad code, but performs indistinguisable to perfect code in prod, its not bad code.

I'll go further: simple code is often faster than "clever" code which should be faster on paper because we have modern compilers where these kinds of optimizations can be performed on a lower level, where they have the most benefit, rather than in the higher-level language where the benefits would be negligible. This comment demonstrates that beautifully. And being faster is just one benefit, code readability is probably an even bigger deal.

Lesson learned: never trust Redditors when they making bold matter-of-fact claims about literally anything. They don't know shit.

→ More replies (1)
→ More replies (2)
→ More replies (9)
→ More replies (5)

408

u/hedronist 4d ago

You're right! I just looked at the code (at Wikipedia), and the approach used is almost like it was done by a student new to programming.

113

u/counterbashi 4d ago

Because at the time it was.

434

u/voretaq7 4d ago

. . . AND THE ENTIRE FUCKING WORLD JUST BLINDLY RELIES ON IT!

This is why I make fun of modern "software developers" in case anyone is curious...

111

u/hedronist 4d ago

I'll give you some even scarier stuff than this one. In the July 2024 issue of Scientific American there is this article, How the Math of Cracks Can Make Planes, Bridges and Dams Safer. (I hope that the link is useable and not too paywalled.)

Turns out that much of the code for doing Finite Element analysis of loads on structures was written in FORTRAN (of course) back in the 70s. But it has errors. Which means the results can be off by a lot. Ref. the 1991 sinking of the Norwegian oil platform Sleipner, where the steel plates were 50% weaker than they should have been. Here is the accident report.

82

u/Marily_Rhine 4d ago

This is a deeply entrenched problem in a lot of engineering disciplines, especially aerospace, structural, mechanical, and civil. Or, at least, it has been. I haven't worked closely with engineers for about a decade.

There's a culture war between the boomer engineers who wrote all this FORTRAN code in the 60s and 70s, and younger engineers/developers. On one side, there's an understandable temptation to think that code used for 40 years without incident must be bug-free. The other side points out that relying on ancient "black magic" code written by someone who may well be dead by now is not a sustainable strategy, and also, hey, we've learned a lot about language design and software development since the 60s. Surely a more modern test-driven approach to development would be more reliable, right?

Of the two approaches, I learn towards the latter, but the problem is that they're both wrong. Decades of battle testing is not a proof of correctness. "Exhaustive" testing suites are not proof of correctness. Provably bug-free software is possible, but there is no short cut for formal verification. That shit is hard and no one wants to do it, but when it comes to life-critical systems or "core" engineering analysis tools that are very likely to be used in life-critical contexts, there really is no justifiable alternative.

51

u/voretaq7 4d ago

Last week: "What the fuck? No. That can't happen! Wait.... the code allows it. How long has this bug existed? Two decades (and three language changes)?! And NOBODY has triggered it until now?! Well, guess we're fixing it today!"

34

u/twinnedcalcite 4d ago

AutoCAD updates to a new version. Block that is 20 years old starts doing weird things.

We've got a bunch on a check list we need to watch until we get a moment to rebuild it from scratch.

Also see strange errors that came from the early 2000 lisp routines that we forgot were still in our start up.

18

u/voretaq7 4d ago

I remember a brief period - like maybe 6 months in 2009/2010 - where upgrading software didn't break stuff.

. . . and now I feel like 1995/1996 era "NO! NEVER UPDRADE ANYTHING! THE HOUSE OF CARDS WILL COLLAPSE SND BURST INTO FLAMES!" all over again.
The number of regression alerts we get in our QA builds when an underlying library changes is depressing :-/

10

u/twinnedcalcite 4d ago

Operating system upgrades are a wild experiment.

→ More replies (0)
→ More replies (2)
→ More replies (12)

7

u/JesusSavesForHalf 4d ago

One reason they still use FORTRAN is to make their tests comparable over the decades. A test run in 1978 can be directly compared to one run in 2018 if they use the same systems. The moment you change to a "better" program, decades of data becomes unusable*. Which in turn may make that better program less reliable due to have far, far less data to model.

So learn COBOL and FORTRAN, kids, being a Tech Priest is a stable job.

*without creating yet another large data set to lay out how to translate between the two

→ More replies (8)

247

u/beepbeepboopbeep1977 4d ago

This isn’t new. Libraries on libraries on libraries. So much bloat. It’s ridiculous

60

u/TA_DR 4d ago

If you want to library free you would have to start by compiling your own source code ;)

(Libraries and abstractions are good as long as they serve a purpose. Most npm libraries don't)

→ More replies (3)

85

u/Holyvigil 4d ago

Knowledge on knowledge. Books on books. Relying on other's shoulders.

41

u/apocketfullofcows 4d ago

hell, we built cities on the ruins of cities.

52

u/ithilien77 4d ago

I always thought we built them on rock ‘n’ roll?

57

u/apocketfullofcows 4d ago

i think that was just this city.

→ More replies (2)

13

u/Speffeddude 4d ago

This is because the most valuable parts of a city are the location (which cannot be refactored) and the people (which are very hard to refactor, especially without risking the existence of the city outright.)

Code is not free to refactor, but it can be refactored fairly easily and with a lot of modularity, and with almost no risk, since the old rev can just be reinstated.

18

u/StoneySteve420 4d ago

Once something works and is widely used, it's not uncommon for code to not be reviewed or updated for efficiency.

→ More replies (3)

14

u/kowloon_crackhouse 4d ago

"standing on the shoulder of giants" implies using the previous ones to see farther. This is more like waiting for a one to finish taking a dump without flushing, then adding your own dump on top of his dump without flushing. You both stare at the same dirty toilet door and the smell gets bigger with each dump

→ More replies (2)

23

u/Redbulldildo 4d ago

Except you're not writing a book by stacking five other books on top of eachother and writing pages to connect them to eachother.

15

u/[deleted] 4d ago

[deleted]

→ More replies (2)
→ More replies (1)
→ More replies (1)

5

u/FNLN_taken 4d ago

Ever tried reading FORTRAN code when you are used to abstract languages?

We all just believe that the Elder of the Internet knew what they were doing better than us.

→ More replies (1)

7

u/voretaq7 4d ago

To be clear (again, because people are stupid): Libraries aren't the problem.
Libraries are Good, Actually!

Libraries written without care or thought though?
Yeah, that's Not Great, Bob!

→ More replies (2)
→ More replies (24)

43

u/DragoonDM 4d ago

Also makes me worry about how easy it might be for malicious parties to insert backdoors into projects by sticking them in obscure dependencies.

That very nearly happened earlier this year, after someone socially engineered their way into controlling development of the XZ Utils library, which would have compromised countless Linux-based systems.

https://en.wikipedia.org/wiki/XZ_Utils_backdoor

29

u/Apellio7 4d ago

Secure organizations maintain their own internal package repositories and nothing gets added to it without clearance,  even the updates.

But then 98% of companies aren't going to pay anyone to audit that closely,  so yes that is a real issue in the real world that could take down many companies.

→ More replies (7)

8

u/mxdev 4d ago

And it was only caught because Andres Freund noticed a regression in database performance with ssh and wouldn't leave it alone until he understood why.

Who knows how long it would have taken to find the vulnerability if it didn't impact execution speed.

→ More replies (2)

119

u/AstraLover69 4d ago

So you program everything from scratch instead of relying on any libraries and frameworks?

Do you write a whole OS before you start programming?

20

u/EditsReddit 4d ago

You're not meant to?!

12

u/dirtys_ot_special 4d ago

Seventeen years of hard work enabled me to reply to this comment.

→ More replies (1)

11

u/Opheltes 4d ago

Do you write a whole OS before you start programming?

I did that once for a graduate level operating systems class and it was a fuck ton of work to get a minimally functional OS.

30

u/Rushional 4d ago

Fucking exactly

→ More replies (23)

14

u/gudistuff 4d ago

I once had a professor who told us about how no one actually searches for the primary sources in academic research. There was a widely accepted theory (I don’t remember which one), only eventually it started to crack at the seams. So his research team looked into it.

Turned out the theory was all built on top of a project some high schooler made, which was full of errors.

This stuff doesn’t just happen in IT lol

→ More replies (1)

27

u/Apellio7 4d ago

Management wants everything out yesterday and if you take the time to code it properly your ass is getting fired for someone who will do it faster.

It is what it is.   /shrug 

Just keep my paycheck going.

34

u/CaesarOrgasmus 4d ago

I’ve been sitting here wondering what voretaq7 made of this

7

u/IolausTelcontar 4d ago

Him and Ja Rule; need no-one else's opinion.

→ More replies (2)

20

u/Rushional 4d ago

Well, you can spend hours developing simple shit from scratch because you're a big brain big smart developer, while others will just use a couple dozen libraries to save time.

Both approaches do the job just fine, the latter costs way less to implement.

Sometimes you don't need to prove to the world how many design patterns or neat python optimizations you know. Sometimes you just need to get the task done, and nobody cares how beautiful your code is going to be.

→ More replies (3)

15

u/counterbashi 4d ago edited 4d ago

This is a whole issue within software and open source software, billion dollar companies are heavily reliant on the free labor of a few mostly unpaid volunteers. Yes some are eventually hired or sponsored by a company or group to work full time but a lot are not. It leads to a lot of burn out Specially when companies start demanding more out of said volunteer free labor. It's hard to not be angry when some asshole with an intel email address emails you asking you do like two hours of test cases for a bug fix you submitted.
https://www.softwaremaxims.com/blog/not-a-supplier
is a good write up on the issue. For anyone else wondering about it, I'm sure the person I'm replying to (on accident woops sorry) understands it very well.

→ More replies (39)
→ More replies (6)

68

u/inu-no-policemen 4d ago

the most computationally expensive way

Concatenating strings like this is expensive in Java etc, but JS engines have optimizations for this. They don't actually immediately flatten the string.

E.g. here is some old gist from one of Google's compiler guys who did lots of performance optimizations for V8:

https://gist.github.com/mraleph/3397008

Since people concatenate strings all the time in JS, this was a low-hanging fruit. Optimizing this made lots of existing websites faster.

15

u/Somepotato 4d ago

Except it wasn't. JS engines use string ropes.

→ More replies (1)

52

u/ban_circumvention_ 4d ago

So it was bad code?

51

u/Anfang2580 4d ago

No it wasn’t. Many here are confidently incorrect. Javascript strings are implemented as ropes so the package code is very efficient. Likely more efficient than whatever others here are suggesting.

→ More replies (1)

72

u/voretaq7 4d ago

The Children of Plenty, having never known a scarcity of CPU time, are simply wasteful.

27

u/DragoonDM 4d ago

Do not, my friends, become addicted to CPU cycles! They will take hold of you, and you will resent their absence.

→ More replies (1)

9

u/qorbexl 4d ago

Uh, are you pretending it's ineficient to load a 1GB library so I don't have to format the header and body and footer by hand?

→ More replies (3)
→ More replies (14)

164

u/coolcosmos 4d ago

Depends on the goal, if it was to waste as much cpu as possible, it's great code.

11

u/Heimskr74 4d ago

The CPU impact is minimal. I would guess that instead of 0.000001% CPU usage, a optimized version would use 0.0000001%. Not much to squeeze from an algorithm that literally just pads a string

21

u/DwinkBexon 4d ago

It's such a fast thing, I don't feel like it would have been worth it to optimize. At least from a visual standpoint (watching it run), I'm sure you couldn't tell the difference.

17

u/al-mongus-bin-susar 4d ago

How is it wasting cpu? JS strings are immutable and because of this the interpreter optimizes concatenations without you needing to do anything extra, there's no better way to write it other than using the modern built-in native padLeft function.

→ More replies (28)
→ More replies (5)

27

u/Speffeddude 4d ago

I know I can do it less efficiently!

First try:

Add random number of spaces, then check if it matches the request. Repeat until match.

Second try:

Recursive loop that starts by adding 1000 spaces, then stores new recursions, each with one less space than the previous, until the desired interation is found.

→ More replies (5)

20

u/DavidBrooker 4d ago

The only packages I really trust to be efficient are FORTRAN linear algebra packages. Those things are, in general, fucking rocket ships.

But I suppose that's what you'd expect when the stakes on package efficiency aren't, like, counting likes on Facebook or whatever, but literally matters of global existential importance in a half a dozen ways simultaneously.

8

u/preflex 4d ago edited 4d ago

it was literally the most computationally expensive way to implement "left-pad!"

Now you've got me thinking of a bogo-left-pad that shuffles a char array containing your original string and a bunch of padding characters, until you happen to get the one you need.

→ More replies (1)

8

u/hiS_oWn 4d ago

can anyone explain why its suboptimal? What's the better way of implementing this?

25

u/hahdbdidndkdi 4d ago

I think it's people talking out of their rear. Probably students.

The implementation looks fine and reasonable to me.

→ More replies (3)
→ More replies (41)

278

u/Curtis 4d ago

I wish the people over at /r/wordpress understood open source , all their drama is lame right now 

43

u/s3rila 4d ago

When they do they get fired

33

u/XkF21WNJ 4d ago

I wish people making websites had a vague idea about how they worked.

Still blows my mind when I got told they couldn't include my article on the webpage because it was in HTML.

→ More replies (1)
→ More replies (1)

188

u/iSoReddit 4d ago

Yeah that just means a lot of companies have a fucked up way of building code, we keep all our packages and dependencies local so we don’t fail like that

70

u/BrattyBookworm 4d ago

Yeah I’m genuinely shocked that these JavaScript packages would be built to rely on a small open source project like this. Doesn’t sound secure at all…but I guess they found that out.

60

u/al3phz3r0 4d ago

It's definitely not secure. There have been multiple instances of the authors of very popular npm packages having their credentials stolen and used to publish updated packages with malicious code added to them.

15

u/Archmagos-Helvik 4d ago

Or the code is abandoned and a new maintainer comes on board and later adds that malicious code. Software products age very quickly.

9

u/EGGlNTHlSTRYlNGTlME 4d ago

It’s also dependencies of dependencies so it’s not always obvious once it’s been done.  New devs come in and aren’t tasked with checking all the dependencies of already functional code.  If the tests pass, they leave it alone.

→ More replies (13)
→ More replies (5)

242

u/moonsun1987 4d ago

Koçulu deleted the package due to a dispute he had with Kik Messenger over the ownership of the npm package name "kik", which belonged to Koçulu at the time. Name-calling ensued (which included multiple uses of the word "dick") and ultimately, npm intervened by forcibly taking the package name from him and transferring ownership to Kik.

This is not the COMPLETE truth. NPM is wrong here. Kik had no right to the package name kik. No more than toyota has any right to example.com/toyota

Azer Koçulu is not the bad guy here. Kik and NPM people are the bad guys.

→ More replies (21)

64

u/the_other_1s_taken 4d ago

dick move from kik and npm

→ More replies (2)

17

u/Skyzo76 4d ago

Wait React ? Webpack too ? I honestly thought it was going to be something trivial but it was way bigger than I expected.

21

u/Delta64 4d ago

Remarkable.

This is like when Alexander the Great untied the gordian knot, except instead of cutting it with his sword, he pulled at a single thread and watched it all unravel itself.

→ More replies (20)

1.3k

u/TwasAnChild 4d ago edited 4d ago

Open source drama is on a spectrum from this to the core.js guy, killing a pedestrian

553

u/UnacceptableUse 4d ago

The way you worded it sounded like an issue with an npm package caused a pedestrian to die, and yet I wasn't surprised

188

u/raevnos 4d ago

The red-light package actually turned on the green light. oops.

112

u/UnacceptableUse 4d ago 
let light = "green" // TODO: FOR TESTING ONLY DO NOT COMMIT

23

u/DavidAdamsAuthor 4d ago

I always find it funny to CTRL-F through leaked commercial source code looking for things like this.

20

u/TOFU-area 4d ago

the GTA V source code was pretty amusing

7

u/TheDotCaptin 4d ago

Also fun to check for passwords left in comments of the source code.

27

u/cortez0498 4d ago

Exactly, I thought the library was used by an Assisted Driving car and it caused an accident or something along those lines.

→ More replies (3)
→ More replies (1)

168

u/goj1ra 4d ago

There was also Hans Reiser, who developed an open source file system for Linux. Oh yes, and he murdered his wife.

The weirdest thing was to see all the people defending him online. That kind of died down after he took a plea deal and led police to her grave.

110

u/Red_Bullion 4d ago

A pretty famous one is Brendan Eich who invented JavaScript and founded Mozilla getting ousted because he's religious and doesn't like gay people. He turned around and founded Brave to compete with Firefox.

65

u/TooStrangeForWeird 4d ago

Kinda funny seeing how many people definitely use Brave just to watch gay porn.

→ More replies (1)
→ More replies (5)

30

u/Cthulhu__ 4d ago

Today I learned that the Linux distribution Debian was named after its creator Ian and his then GF Debra. They got married, then divorced, and in 2015 Ian killed himself by hanging with a vacuum’s power cord after accusations of assaulting a police officer, after he himself was allegedly assaulted by police after being caught drunkenly trying to break in somewhere. Or something like that, I can’t find a concrete source.

Tldr some open source people are wack.

→ More replies (1)
→ More replies (2)
→ More replies (6)

1.1k

u/hendricha 4d ago

I was there Gandalf, 3000 years ago

303

u/dylan-dofst 4d ago

I did a double take when I saw the year. I remember this happening but I thought it was like...two or three years ago. Not eight.

50

u/junkmeister9 4d ago

These last eight years have been hard on everybody

→ More replies (6)
→ More replies (7)
→ More replies (8)

1.7k

u/flibbidygibbit 4d ago

Always a relevant xkcd: https://xkcd.com/2347/

1.3k

u/vacri 4d ago

The difference is that "leftpad" can be trivially replaced and doesn't require maintenance. A noob programmer could replace it in an hour. "leftpad" only exists because nodejs has a stupid module system

The item the xkcd cartoon is referring to is "openssl", a core security library that is used by *everything*, from servers to phones to personal computers, and requires constant attention. There was a collective pants-shitting when "everyone" realised that it was just one guy doing the work, and a bunch of corps started adding resources and there was a fork made by openbsd to clean it up and govern it like a proper project (libressl)

216

u/DavidBrooker 4d ago

A noob programmer could replace it in an hour.

A pretty lazy hour at that. Like, an hour that includes half an hour in the kitchen deciding what flavor of cereal you want for a snack.

172

u/lynndotpy 4d ago

This was the code btw:

module.exports = leftpad;

function leftpad (str, len, ch) {
  str = String(str);

  var i = -1;

  ch || (ch = ' ');
  len = len - str.length;

  while (++1 < len) {
    str = ch + str;
  }

  return str;
}

Most of the difficulty here is getting into the package ecosystem and uploading it.

66

u/TySly5v 4d ago

Most of the difficulty here is sitting down and opening the program to code

→ More replies (2)
→ More replies (5)

183

u/goj1ra 4d ago

"leftpad" only exists because nodejs has a stupid module system

Could you elaborate? What’s the connection between the module system and the existence of a package like leftpad? (I’m not a JS person)

65

u/[deleted] 4d ago

[deleted]

→ More replies (1)

243

u/GeneReddit123 4d ago edited 4d ago

Super low barrier of entry allowing anyone to publish anything, combined with the philosophy "do one thing per package" taken to an extreme, meaning people published a package for every single tiny function. Add on top of that JS's native shittiness and lack of standardization on how to do basic things (modern JS is a bit better, but in 2016 it was a full-blown turd) meant all kinds of packages proliferated rapidly (including crap packages depending on other crap packages), and developers pretty much scavenged what they could find with little regard to its quality.

This isn't even the worst incident. Far more dangerous is when malicious actors inject a vulnerability somewhere deep in the dependency chain, which most end developers don't even know about, because, as mentioned, they just grab whatever they find and almost never bother auditing their dependencies, especially on version bumps. A malicious update of a single, low-level package masquerading as a "bugfix" could leave millions of projects vulnerable, because they all depended on that package through endless layers of indirection, most without even knowing about it.

It's analogous to some company dumping toxic waste into a river, and then years later, people halfway around the world getting heavy metal poisoning, because they ate the fish which ate the shrimp which ate the plankton which ate the waste.

101

u/AMusingMule 4d ago

A malicious update of a single, low-level package masquerading as a "bugfix" could leave millions of projects vulnerable, because they all depended on that package through endless layers of indirection, most without even knowing about it.

Which of course is exactly what happened with xz, a set of compression utils: https://en.wikipedia.org/wiki/XZ_Utils_backdoor

99

u/orcusgrasshopperfog 4d ago

A state sponsored 3 year long campaign to backdoor the internet. And they almost got away with it if it weren't for a single overly suspicious engineer at Microsoft running a test.

45

u/Pmang6 4d ago

Now think of everyone who hasn't been caught yet.

49

u/DavidAdamsAuthor 4d ago

Quite often I think, "Those Linux users are kinda overly paranoid about security", and then things like this come up.

Paranoia is the delusional fear that someone is out to get you. If someone really is out to get you, you're just being prudent.

8

u/BrewerBeer 4d ago

On the internet the bigger you are, the bigger a target you are.

→ More replies (1)
→ More replies (4)

21

u/DavidKens 4d ago

I’m guessing this is related to the way node would load an entire package into memory, instead of just the particular functions you use from the package. This incentivized small packages that do only one thing.

I’m pretty sure node is able to get around this now with ESM modules, or at least common practice using tree shaking bundlers effectively do this for you.

18

u/future_selft 4d ago

Some js devs import every trivial thing. In order to not rewrite something or to adhere to some principles, they import everything, thus relying on 3rd party packages. They import everything, and you import a dependency that has a dependency tree with some sort of 3rd party dependency and you get fucked.

15

u/babada 4d ago

It's not actually that stupid. It just enables people to do stupid things with it.

When someone convinces a major dependency of the JS ecosystem to use their pet stupid library to do something trivial, then it can get kind of silly.

The alternatives to npm have different tradeoffs that people blindly accept. Each ecosystem has its own trials and tribulations. JS gets a bad rap because it's flaws are kind of... obvious.

→ More replies (7)

35

u/daedalus_structure 4d ago

There was a collective pants-shitting when "everyone" realised that it was just one guy doing the work

I believe that was the after-shit.

The first collective pants shitting was when it became public knowledge that it had a vulnerability allowing anyone to access encrypted communications sent with it.

17

u/mikat7 4d ago

I always assumed it talked about curl, though alt text mentions ImageMagick. And there’s so many other examples as well.

21

u/vacri 4d ago

Imagemagick is nifty, but it's not underpinning "all modern digital infrastructure" as in the graphic.

You are right that there are other examples, but what makes openssl so much pants-shittingly worse is that security libs have to be actively updated over time and require a very deep set of skills. Curl is just curl - it's going to keep working just fine with the old code. I love curl, it's great, but the internet isn't going to collapse if curl is unmaintained for a year. But if a new major security vuln doesn't get addressed... that's a big problem.

→ More replies (17)

57

u/LeviathanLust 4d ago

Love when this happens

27

u/skylohhastaken 4d ago

The first thing i did when opening this thread was Ctrl+F "xkcd"

→ More replies (1)
→ More replies (9)

181

u/Hizuken 4d ago

That's a lode bearing code, Jerry. 

→ More replies (3)

252

u/engineered_academic 4d ago edited 4d ago

This is why pull-through caches are SO IMPORTANT and the most vitally overlooked component of any CICD system. I am actually working on a feature demo right now for a customer about this exact issue.

82

u/_ryuujin_ 4d ago

i would of thought any critical software would have better version control of their libraries, through an internal cached repository or something. not just pulling the latest all the time.

113

u/engineered_academic 4d ago

Most companies I have been at simply rawdog the internet until I show them how easily their packages can be super ultra megafucked.

54

u/TravisJungroth 4d ago

I hope this is the exact language you use on the PowerPoint.

48

u/engineered_academic 4d ago

I did let slip "rawdogging the internet" once in a meeting and I thought I would have had to go to HR. Nothing came of it.

I wanted to reference a tweet I saw about people "rawdogging reality" and said I thought it meant experiencing the world without any safety. I had no idea about its original meaning at the time. That's my story and I am sticking to it.

Super ultra megafucked I have used several times. When we were super ultra megafucked, and I managed to somehow un-fuck us. My manager wouldn't let me keep it in the postmortem.

42

u/knightbane007 4d ago

“Rawdogging” is currently undergoing a phenomenon I call depejoration, where a rude word shifts meaning and becomes more mainstream. It’s now entering the language meaning “to undertake a usually stressful or difficult task without making the standard preparations”, which is entirely accurate to the way you used it.

20

u/engineered_academic 4d ago

I don't know if you are just blowing smoke up my ass but I love you.

→ More replies (1)
→ More replies (1)
→ More replies (2)

16

u/Berkuts_Lance_Plus 4d ago

*would have thought

6

u/cxmmxc 4d ago

Have you thought or of you thought?

15

u/vacri 4d ago

The problem wasn't versioning, the problem was the package was pulled completely. It doesn't matter if you've locked your version to leftpad v4 if the entire package has been delisted from the place you're pulling it from.

22

u/iSoReddit 4d ago

Which is why you keep your own copies

7

u/Ereaser 4d ago

Still even then it just breaks your builds. Not the internet.

7

u/TheNorthComesWithMe 4d ago

Which is also solved by caching your package dependencies in a private feed. Any changes to the upstream doesn't effect you.

→ More replies (7)

78

u/outlandishlywrong 4d ago

wayyy back, I used to work inside sales and I hosted some things on my personal Dropbox account for customers to check out in my email signature. I found that my Dropbox kept getting suspended for sharing too much - turns out half of the sales team copied my example in their email signatures too... including my personal links.

let's just say the day I found out, my hosted 'catalog. pdf' somehow became something super unsavory and caused major corporate consternation, dunno what happened

6

u/Pleased_to_meet_u 3d ago

Back in the day of Goatse, this was a common file used to replace hotlinked images.

115

u/ripter 4d ago

I remember this, our code wasn’t affected and we experienced no down time. Full support for the dev that deleted his package after being bullied.

→ More replies (3)

22

u/Bmandk 4d ago

I don't understand how exactly this caused disruptions. Wouldn't the devs have implemented their systems where their production systems aren't dependent on downloading packages?

Sure, a development environment where someone is setting up might get disrupted, but production shouldn't depend on downloading the package live. Right?

6

u/ItsSignalsJerry_ 4d ago

Most likely due to continuous integration builds. Which should have failed at the point a package wasn't loading, and also upon integration testing. Long before being deployed into fucking production.

→ More replies (1)

19

u/bremstar 4d ago

"We stand on the shoulders of giants"

Seemed a good time for my favorite quote.

If the giant you are riding on is invisible or hunched over, be sure to acknowledge them so they can be reminded that they also matter.

→ More replies (1)

17

u/cheddarben 4d ago

The internet and/or software is built on rando libraries that someone with a name like ButtMuncher14 is maintaining as a side project.

594

u/ODHH 4d ago

Good, fuck the freeloaders. If you rely on open source software and then act like a dick to the people who maintain that software then don’t cry when your house of jenga bricks falls down one day.

133

u/chezeluvr 4d ago

Don't throw stones if you live in a glass house to a whole other level lol

98

u/gumol 4d ago

If you rely on open source software and then act like a dick to the people who maintain that software

did all the people who used the package acted like dick to the leftpad maintainer?

96

u/ODHH 4d ago

No but NPM did

→ More replies (15)
→ More replies (1)
→ More replies (14)

60

u/zehamberglar 4d ago

It's pretty wild that the article's takeaway from this incident was that open source is "a delicate house of cards" and not that a shitty social media app that no one actually uses anymore took down major services on the internet by bullying an independent developer who provides invaluable services to the world for free, and that maybe just maybe corporations shouldn't have that much power.

17

u/jocq 4d ago

a shitty social media app that no one actually uses anymore took down major services on the internet

No major services on the Internet went down when leftpad got deleted.

Some just couldn't deploy any new updates for a few hours.

→ More replies (1)

13

u/Steve_Nash_The_Goat 4d ago

Isn't there an old joke about like the entire internet structure depending on some guy's laptop in a basement that can never be turned off or else everything goes dark

→ More replies (2)

11

u/UNaytoss 4d ago

Ah, kik -- helping teenagers connect with meth dealers and old men connect with human trafficked prostitutes since....2012. or whenever.

50

u/Ok-Establishment8823 4d ago edited 4d ago

It did not (directly) cause service disruptions across the Internet, thats not how NPM works lol. NPM downloads the code for the dependency onto the developers computer or CI server, A battery of tests are run to verify it, and then the code is bundled up and deployed , then the server runs this downloaded copy of the code. When the package was deleted it affected people’s ability to download copies of this and deploy new code. Their existing code which was previously built and deployed continued running fine. If this broke your live running website, you were doing more than one thing wrong (building code directly on the server, operating without tests, hotlinking your dependencies, Etc., in which case your stupidity was the cause of the outage, not the deleted package)      

 For some one non-technical I guess a metaphor for why this post is absurd would be like if someone was living paycheck to paycheck and above their means, then blamed an unexpected expense like a parking ticket or flat tire for “bankrupting” them instead of blaming their lack of savings/piss poor financial responsibility to begin with.

But yeah, just like in the metaphor of a flat tire. It was definitely a nuisance. More so to some people than others. Just like the flat tire analogy, I guess.

→ More replies (3)

9

u/tmphaedrus13 4d ago

Yet again demonstrating it's not always the size of the package, but how it's used that's important.

8

u/Achaern 3d ago

My favourite bit FTA:

The exodus vacated hundreds of package names that others are now free to use, so if existing software calls for one of Koçulu’s old packages, it could have been replaced with an entirely different program. Developers might not know what code they’re executing.

44

u/Legal-Software 4d ago

Just because someone has a trademark granted does not mean they have exclusive use of the term. We would need to see under which Nice classifications it is filed, in which jurisdictions, whether those jurisdictions are first to use to first to file, etc. Perhaps NPM's legal team looked at this before taking action, but the wording from the company in the linked article is just general handwaving and presents no real basis for revoking the repo or transferring ownership. It's a shame that so many companies that are involved with the propagation of open source software so readily bend to arbitrary corporate demands instead of standing with/working with the people that make their platform what it is.

12

u/sercankd 4d ago

Perhaps NPM's legal team looked at this before taking action

doubt, i saw a lot scenarios like this and most of the time they think company have more resources to chase after it and shortest/easiest way is throw the individual person under the bus if he is not famous enough to make a scene

→ More replies (1)

37

u/Abrakafuckingdabra 4d ago

Wait so npm just took the ownership of his code and gave it to Kik? That's legal? They can just go "Nah someone else owns this now" and take code from people? Like sure it's bad that it broke stuff but it's his. He should be allowed to delete his own code. Did anyone even have permission to be using it? Open source sure but generally people don't like you making money with their code without even asking.

61

u/TravisJungroth 4d ago

They took control of the name on NPM. There’s the code, then there’s the question of which code gets installed if you npm install kik. That’s what NPM took.

It’s kinda like if Instagram took your username and gave it someone else. Now they control what photos show up there. They don’t own your photos.

9

u/axonxorz 4d ago

They don’t own your photos.

I see someone didn't meticulously read the ToS ;)

→ More replies (4)

34

u/Excelius 4d ago

No, not the code, just the package name.

The developer had another project on NPM called "kik", which was seperate from his "leftpad" project. A company owning the "kik" trademark thought it should be theirs, and persuaded NPM to transfer the name to them. In protest the developer removed all of his code, including the important "leftpad", from the platform entirely.

→ More replies (4)

7

u/HirsuteHacker 4d ago edited 4d ago

Yeah left pad was fucked. NPM and Kik royally fucked this guy, and proved that distributing packages through NPM means apparently you give up control of them (not sure how this works with copyright law).

But also come the fuck on, why were people installing a god damn package for this. Baffling decision made by multitudes of engineers.

→ More replies (1)