[Affric]

What a dissatisfying non-apology of an apology.

> First, just want to apologize about any difficulties this package has caused.

No rationale. No shame. Just the word “apologize” in a sentence.

Who downloaded it though? Surely as a dev if you download such a package it’s on you?

[Retr0id]

He didn't kill someone's puppy, he just published some interesting data that others' code struggled to cope with. He was irresponsible perhaps, but I don't think he foresaw doing any real damage, and I don't think he needs to be especially sorry for it.

[Affric]

I haven’t compared it with killing someone’s puppy. I just think that it would genuinely be helpful to explain a little bit of the rationale and any insight gained from the totally predictable but apparently “unforeseen issues” [1].

It’s the world of worse is better and they’re going for the widest possible area of effect. Should we crucify these guys? 100% not. Part of this is on npm’s design and implementation. Part of it is cultural.

But these guys owe the people who were needlessly “inconvenienced” a little more than just the word “apologize”. Not their first born but some rationale which justifies or reveals that they realise it was a bit pointless or stupid.

[1] https://uncenter.dev/posts/npm-install-everything/

[nosefurhairdo]

Perhaps NPM should apologize for shifting blame and failing to address the root cause.

The wildcard "any version of dependency" preventing unpublish is clearly flawed. The "everything" package folks had no malicious intentions, and nobody would benefit from a long-winded, ashamed apology. If not for NPM's flawed unpublish policy the everything team would've unpublished to resolve the issue.

[Affric]

I agree to a large extent but I am not sure even rereading my comment that I can take that that’s what I am advocating for.

I just think it would have been good to give the “I was hoping to investigate X, I did not expect Y, I can see now that it was irresponsible to do X.”

I don’t think that’s particularly long winded.

[mkoryak]

I don't think he was trying to investigate anything. He was just trolling, but he didn't intend to troll _that hard_.

[urbandw311er]

Do you think he should be ashamed? Granted I may have overlooked something, but as far as I can tell it wasn’t an intentionally malicious act, it was a bit of a curious experiment. Seems rather inline with the HN values to me.

[Affric]

Shame is a spectrum. I don’t think he should flagellate himself until the end of time. I think that they should be a little bit embarrassed that they haven’t published what they believed the risk of the everything package was.

Upon rereading the article I can see that the word “unintended” is actually not Patrick’s but the author of the recap’s word.

Beyond that you seem to be ascribing benign intent. Reading it from the horses mouth [1] it doesn’t seems like they had any intent other than trying to find out if it could be done. In a world of worse is better creating the largest possible area of effect for your experiment seems to be a pretty easy way to amp up the consequences of your actions regardless of the risk.

[1] https://uncenter.dev/posts/npm-install-everything/

[jonorsi]

Why does he even need to apologize? If anything, npm should apologize and thank him for revealing a huge issue in their unpublishing policies unmaliciously.

[philipwhiuk]

I think there's a point when you're trying to do something really stupid and hack around the defences (e.g. rate limits and package JSON file sizes) that it's no longer an accident.

[Affric]

Ah yes… thank him for ingeniously and tirelessly working around their dependency limit…

[Waterluvian]

Yeah. I’m honestly not sure where any of this “package chaos” actually exists. I mean… there’s incompetence everywhere in every language, so yes there. But I’ve yet to run into a friend of a friend who has a horror story about these dependencies.