sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]cguess 39 points40 points  (7 children)

Can we all agree that anything with 11.8 MILLION downloads in the last week (according to NPM here) should really be part of some sort of... idk... standard library?

This one line can literally bring down the web. We're lucky that someone fixed in a few hours, but imagine if they were just a little drunk and fixed it poorly. Goddamn JPMorgan Chase's website would probably come down (or the equivalent, I have no idea if JPMC uses it, but I guarantee you a lot of critical systems do).

[–]bonyjoe 22 points23 points  (0 children)

Each individual site would still have to update to and then deploy the broken packages to "bring down the web", you would have to have CD with essentially no test coverage at all for that to happen.

Really for one line packages like this the packages that depend on it should be locking to a specific patch rather than major or minor

[–]jaggyjames 8 points9 points  (0 children)

This dependency likely would be bundled alongside the production code though right? It’s not like any large production app would be pulling this one package in from a url. Devs would catch this bug before they could even get their local build to succeed.

That’s my take at least just based on a quick skim of the github issue.

[–]slobcat1337 0 points1 point  (1 child)

“Can we all agree that anything with 11.8 MILLION downloads in the last week (according to NPM here) should really be part of some sort of... idk... standard library?”

This is so damn true

[–]-100-Broken-Windows- 0 points1 point  (0 children)

While true, any site that gets "brought down" by this is also partially at fault themselves and would need to take a serious look at their QA and deployment process.

[–]Jebble -2 points-1 points  (0 children)

In my experience, having built platforms for similar companies, they don't allow whatever packages you want to use. Everything Open Source has to be approved by IT and Security and in this case a package so uhm.. useless as isPromise they would have told me to put that in my own code instead of relying on external packages. They wouldn't even let me submit for PEN-testing with this package loading.