Azer Koçulu

I guess some see a risk of mutability(https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be6… But you can always use shrink-wrap or other package managers that guarantee immutability. Oh, I guess I should say I love npm/yarn and use it as a core of all my projects. ️

This is poetic, and somewhat funny, but also kind of nonsense. The article pretty much nails it when it talks about choice of tools, frameworks, and libraries being dictated by the kind of problem you want to solve. For me, if I'm going to add another library or tool into the mix, it has to be because it's adding some clear value to what I'm doing. If not, it stays out. Classic example: I have a games site I'm working on that uses lodash, and only lodash (actually only a subset), because a key factor for me is keeping that page weight down so people accessing the site via mobile on a capped data plan and a laggy connection don't have to wait an age for the game to load because I'm downloading 1MB of minified JavaScript libraries. That means that some things I need to do are more work than they otherwise might be for me, but that's OK because it's helping me hit my objectives. All of that being said, whether you like it or not, "How it feels to learn JavaScript in 2016," makes some valid points, and certainly captures that feeling of being completely overwhelmed that I hadn't experienced with other languages and ecosystems. You can substitute 2013 for 2016 and it exactly resonates with the way I felt back then, when I returned to JavaScript after a 10+ year absence. The maligned "snark" just goes with the territory. As far as I can see the JavaScript community seems to thrive on upheaval and butthurt; it feels professionally immature and full of easily bruised egos who…

Kozmos (https://getkozmos.com) | Full-stack Engineer, Marketing | Remote Bookmarking simplified into one button. It automatically organizes users bookmarks, providing an advanced search engine. (Read more at https://medium.com/@azerbike/introducing-kozmos-a-new-bookmarking-plat… Kozmos' tech stack is Go, Preact, Elastic Search, LevelDB and MySQL. We need engineers with ML background to help us build a better search engine. Check out the product at https://getkozmos.com Ping me directly with your Github and resume at [email protected]

It organizes your bookmarks into categories without requiring tagging. Behind of the scenes, it automatically tags the content. And its advanced search engine lets you find your bookmarks easier than other services. You can watch the video to get a hint :) There is also this blog post; https://medium.com/@azerbike/introducing-kozmos-a-new-bookmarking-plat…

> Code Depends on too Many External Pieces Does anybody remember this? https://medium.com/@azerbike/i-ve-just-liberated-my-modules

Re 2: Perhaps the auditor isn't referring to open source products being shutdown, but rather package info being pulled abruptly making the package inaccessible for some period of time. Particularly I'm thinking of the whole npm left-pad fiasco (http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm, https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be6…

You also install Node.js scripts, that may just execute anything upon "require". "npm install --ignore-scripts" won't save you. But bash scripts... oh, yeah... lethal. There are problems with NPM, for sure. Like dependency level, absence of possibility to review new releases, being rather closed than open (https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be6… Maybe going with open solutions for package management will solve most of this problems. Like using git protocol to host ones libraries on github (or gitlab or bitbucket or anything where you can fetch dependencies and get to review the code). Of course, this is not that simple as it sounds.

https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be6… discussed here in this thread : https://news.ycombinator.com/item?id=11340510

I believe this is what OP is referring to: https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be6…

Here is Azer's side of the story: https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be6…

I think that unfortunately this was a foregone conclusion. Copyright law, like most other laws in our society, favor corporate interests. I support his stand on principal, however. Azer is a talented developer and has an impressive life story, and has certainly contributed more to society than a social network well know for invading children's privacy. https://medium.com/@azerbike/i-owe-my-career-to-an-iraqi-immigrant-2c0… https://en.wikipedia.org/wiki/Kik_Messenger#Controversies

For those who are out of the loop. This is refering to https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be6…

And the reason for unpublishing is at https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be6…

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with 2.5M/month), meaning a malicious actor could publish a new patch version bump (for every major and minor version combination) of these libs and ship whatever they want to future npm builds. Because most package.json configs use the "^1.0.1" caret convention (and npm --save defaults to this mode), the vast majority of future installs could grab the malicious version. @seldo Is there a plan to address this? If I'm understanding this right, it seems pretty scary :| [1] https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be6…