I've heard people mention curl and imagemagick. Any others that you know about?
A developer maintained a NodeJS package called left-pad that would add leading whitespace to strings. He unpublished the package and broke basically the entire Node ecosystem until the repo owner forcibly republished it against the author's wishes.
Werner Koch, the guy who created, and who has maintained for 25 years now, pretty much all by himself, GnuPG, the modern email encryption replacement for PGP.
Just the other day, I realized I actually live just a few kms away from the guy, here in Germany ... very tempted to reach out to him someday and actually buy him an actual coffee.
Log4j was a fun one to watch unfold everywhere when things went haywire
The neat thing about the log4j thing was even a cursory explanation of the vulnerability made anyone with a passing familiarity with security say, "Why the fuck would that even be a feature?!"
Wait until you learn that PDFs support embedded Javascript.
Alexandra Elbakyan manages this truly awesome source of scientific papers completely on her own. She got sued twice and lost, had to change the URL multiple times due to takedowns and only gets along by donations.
It is a crime to humanity to lock knowledge behind a huge paywall. She does God's work.
And it's not like the actual scientists/academics support knowledge being locked away either, or profit from it.
The core-js library is used by 1000s of top websites and is maintained by one guy https://github.com/zloirock/core-js
Who maintains ffmpeg?
cURL was one of these for a while (according to my limited understanding)
It was made in the 90s and it didn't get commercial support until a few years ago.
Node frameworks are famous for this purely because of a lack of standard library. I feel like most languages have a standard library that balance being generic but still providing utilities of common used stuff. So a company that doesn’t want to rely on a random guy’s library can build their own with only the features they want. But with Node, any complicated feature is using a tree of hundreds of random packages that you have no idea who created them.
The "left pad" incident refers to a controversy that arose in 2016 when a developer named Azer Koçulu removed his JavaScript package called "left-pad" from the NPM (Node Package Manager) registry. This caused a ripple effect, breaking numerous projects that relied on this package and highlighting the potential risks of relying on external dependencies. The incident sparked a debate about the stability and trustworthiness of the open-source ecosystem and led to discussions about best practices for managing dependencies in software development.
This famously broke builds at Facebook.
This is the one I came to post about. The fact there's a library for this is so stupid to me.
I feel like it demonstrates how npm and modules have probably to some degree gotten out of hand.
I don't get it. What's funny about "A complete film set up for the day less than a week and a half hours or so to get a new Hampshire the same thing we have to do yay for it to be done with the repellant the same thing we have to do you have to be a car or a goat does it make you feel better than I expected it to my mother-in-law and I will be there in a few minutes to be there for you to get back to me is getting a little bit of a man on the way to work through the ditches the other day and I will be there in the morning and I will be there in the morning...
Did you just keep tapping the center predicted text suggestion?
Basically every Windows sysadmin is indebted to Mark Russinovich and SysInternals. Fortunetly, PowerToys has come a long way because I'm pretty sure sysinternals haven't been updated since Windows XP.
Mark Russinovich now works for Microsoft and they own Sysinternals. Also the tools get updated quite regularly.
"Mark works for MS" is a massive understatement. He's CTO of Azure now.
And speaking of Sysinternals, arguably the most exciting update was when ProcessExplorer got a dark mode late last year :)
A developer maintained a NodeJS package called left-pad that would add leading whitespace to strings. He unpublished the package and broke basically the entire Node ecosystem until the repo owner forcibly republished it against the author's wishes.
https://www.theregister.com/2016/03/23/npm\_left\_pad\_chaos/
Werner Koch, the guy who created, and who has maintained for 25 years now, pretty much all by himself, GnuPG, the modern email encryption replacement for PGP.
Just the other day, I realized I actually live just a few kms away from the guy, here in Germany ... very tempted to reach out to him someday and actually buy him an actual coffee.
Log4j was a fun one to watch unfold everywhere when things went haywire
The neat thing about the log4j thing was even a cursory explanation of the vulnerability made anyone with a passing familiarity with security say, "Why the fuck would that even be a feature?!"
Wait until you learn that PDFs support embedded Javascript.
What was it?
https://theconversation.com/what-is-log4j-a-cybersecurity-expert-explains-the-latest-internet-vulnerability-how-bad-it-is-and-whats-at-stake-173896
Sci-Hub anyone?
Alexandra Elbakyan manages this truly awesome source of scientific papers completely on her own. She got sued twice and lost, had to change the URL multiple times due to takedowns and only gets along by donations.
It is a crime to humanity to lock knowledge behind a huge paywall. She does God's work.
And it's not like the actual scientists/academics support knowledge being locked away either, or profit from it.
The core-js library is used by 1000s of top websites and is maintained by one guy
https://github.com/zloirock/core-jsWho maintains ffmpeg?
cURL was one of these for a while (according to my limited understanding)
It was made in the 90s and it didn't get commercial support until a few years ago.
Node frameworks are famous for this purely because of a lack of standard library. I feel like most languages have a standard library that balance being generic but still providing utilities of common used stuff. So a company that doesn’t want to rely on a random guy’s library can build their own with only the features they want. But with Node, any complicated feature is using a tree of hundreds of random packages that you have no idea who created them.
I believe the nodejs fiasco is what prompted this comic?https://www.google.com/amp/s/www.theregister.com/AMP/2016/03/23/npm_left_pad_chaos/
Another example is a large number of libraries using an external dependency to check if a number is odd.
Left pad https://arstechnica.com/information-technology/2016/03/rage-quit-coder-unpublished-17-lines-of-javascript-and-broke-the-internet/
Had GPT summarize what happened.
This famously broke builds at Facebook.
This is the one I came to post about. The fact there's a library for this is so stupid to me.
I feel like it demonstrates how npm and modules have probably to some degree gotten out of hand.
Would you like to hear an OpenSSL joke?
It's 64k letters long and you can repeat it back to me when I'm done.
It's "A".
https://www.heartbleed.com/
I don't get it. What's funny about "A complete film set up for the day less than a week and a half hours or so to get a new Hampshire the same thing we have to do yay for it to be done with the repellant the same thing we have to do you have to be a car or a goat does it make you feel better than I expected it to my mother-in-law and I will be there in a few minutes to be there for you to get back to me is getting a little bit of a man on the way to work through the ditches the other day and I will be there in the morning and I will be there in the morning...
Did you just keep tapping the center predicted text suggestion?
I didn't even know about core-js until the dev complained about all the sites which use it. https://github.com/zloirock/core-js/blob/master/docs/2023-02-14-so-whats-next.md
Basically every Windows sysadmin is indebted to Mark Russinovich and SysInternals. Fortunetly, PowerToys has come a long way because I'm pretty sure sysinternals haven't been updated since Windows XP.
Mark Russinovich now works for Microsoft and they own Sysinternals. Also the tools get updated quite regularly.
"Mark works for MS" is a massive understatement. He's CTO of Azure now.
And speaking of Sysinternals, arguably the most exciting update was when ProcessExplorer got a dark mode late last year :)
Wait? ProcessExplorer has dark mode???!