On "White Fragility" - <AUTHOR> https://taibbi.substack.com/p/on-white-fragility <comment><USER2> I am amazed that I work at a company full of extremely intelligent individuals, some of whom are truly cream of the crop types given the work we do.

Yet, during the Floyd protests, our equity committee sent out an email with a recommended reading list including white fragility and other similar books.

Only books that had a similar premise were included, no smart, critical books (including some I can think of written by POC) with any other conclusions or arguments were included.

Everything in the company, from the big picture down to the smallest details, received critical scrutiny and thoughtful didcussion- from architecture to code style to customer experience to market position.

And yet, any topic that can end with -ism (racism, genderism, etc) can not ever be scrutinized. Words like "blacklist" are abolished, in spite of both prior art and POC employees being (privately) offended that they are thought of as being so fragile. The atmosphere is so thick on such topics that no-one speaks up for fear of being fired.

<comment><USER3> "blacklist" isn't banned because it is thought to hurt black people's feelings. It's banned because it promotes a psycholiguistic effect tending to disrespect black people.

<comment><USER4> "psycholinguistic effect": that's so ethereal as to be meaningless and unfalsifiable. That's the insidious part too with a lot of anti-racism. You can scarcely disprove or prove any of it.

<comment><USER5> I think it's pretty clear what gowid is saying here. The "psycholingustic effect" is the psychological effect on people of color of a language tradition that enforces the idea that light = good and dark = bad. Reasonable people can disagree on how pronounced the effect _is_ and where to draw the line, but it's not meaningless.

I've seen posts elsewhere that claim the etymology of blacklist, specifically, isn't based on this metaphor, but this metaphor exists throughout English. Consider this line from _A Midsummer Night 's Dream_, "Not Hermia but Helena I love. Who will not change a raven for a dove?" where light > dark is so _obvious_ that all you have to do is compare one girl to a dark bird and one to a light bird to make your point.

Again, it's possible to go to far with this (e.g. whitespace), but that's a question of _where_ to draw the line, not _if_.

<comment><USER6> The problem is that it isn't a language tradition, it's inherent in the nature of "darkness" (i.e. the absence of light) as a concept. When it's dark you can't see, it's night so it's cold and there could be predators etc.

If we're going to make a change to language then it should be to stop describing _people_ as black or white. Which was never particularly accurate to begin with, since "black people" are really varying shades of brown and "white people" are varying shades of pink to light brown anyway.

I assume it's too much to ask that we stop categorizing people by "race" entirely.

<comment><USER7> Batman is a superhero that operates in darkness and has black clothing, yet people don't think of Batman as the BBEG of their comics, no?

There is an entire TVTropes page dedicated to "Dark Is Not Evil" and it's not a purely subversive trope either, quite popular in media as well.

There is also plenty of media (and culture) where darkness is sacred and pure, not evil or cold. Consider the dwarves in the discworld series that hold this belief. For more real-life examples, the hebrew bible generally refers to shadows and darkness as good since when you live in a desert, those things will bring you some fresh air and protection from the sun.

<comment><USER6> > Batman is a superhero that operates in darkness and has black clothing, yet > people don't think of Batman as the BBEG of their comics, no?

Superman: Literally powered by the light of the sun, boy scout who never breaks the rules, hard-working member of the proletariat.

Batman: Tortured soul with tragic backstory, lawless vigilante, billionaire (regarded as evil in popular media, cf. Lex Luthor).

The darkness in Batman is the adversity the hero has to overcome. It's integral to the story but it isn't _pleasant_. You can't imagine the young Bruce Wayne wishing for somebody to murder his parents so he can grow up to don a bat suit and punch criminals in dark of night.

And so it is with the other common depictions of darkness in hero types -- an internal struggle, not a desired characteristic in itself.

You can find the odd situation where darkness actually is positively desirable in itself, but not enough to overshadow all of the more common ones where it isn't.

<comment><USER7> I don't believe darkness being positive is the odd one out. Even major media has "darkness = good" not as a subverise but integral trope (see, for example, darkness).

I don't agree with your assessment of Batman and I would point out that Batman isn't regarded as evil in popular media (and even if he was, Superman was evil plenty of times, see Superman Red Son)

Lastly, I would mention that in hero types, a internal struggle is usually desired to counterbalance or embolden external conflict. Even superman has internal conflicts.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> > A bizarre echo of North Korea's "three generations of punishment" doctrine > could be seen in the boycotts of Holy Land grocery, a well-known hummus > maker in Minneapolis. In recent weeks it's been abandoned by clients and > seen its lease pulled because of racist tweets made by the CEO's 14 year-old > daughter eight years ago.

Seeing stuff like this makes me wonder why people keep using social media at all.

It's terrible that this guy's daughter made racist posts 8 years ago, but we have no idea what kind of person she is today. She could be doing community organizing against police brutality and it wouldn't matter at all.

The posterity of childhood is one of the most dystopian aspects of our technology-driven society. It's like a 2020 version of the Scarlet Letter.

<comment><USER9> Her most recent racist post was 2016, at age 18 or 19 and she held a senior position at the company. The author of this piece doesn't seem to be super intellectually honest, in addition to his Godwin's law-breaking.

<comment><USER3> A "senior position" at a family hummus shop? Really?

<comment><USER10> Is Walmart a family store too?

>Beginning as a small shop in 1986, Holy Land has expanded into a sprawling business that includes an eatery, grocery store, catering business, and commercial food business, with a large restaurant and production facility in Northeast Minneapolis and a stand at the Minneapolis/St. Paul Airport. Its hummus, sauces, and flatbreads are carried by several area grocery stores.

<comment><USER11> A company with one restaurant in one city is suddenly Walmart?

There's a place like that in this town, it has 4 or 5 people working there and two of them are the owner's sons -- they have a restaurant, and in the back they put spices and vegetables into bags and sell them to two local markets, and also in the hallway of the restaurant, which doubles as their "grocery store". They cater, too. This is a town of ~30k.

Small businesses have a habit of aggrandizing themselves. The royal we and such.

</comment></comment></comment></comment></comment><comment><USER12> A rough heuristic I've found historically very useful to judge the relative sanity of a group or person on matters of race is the question "Do you want to ban _Huck Finn_?"

If you do, then I shall waste no time shaking the dust off my feet when I leave, because two things are true as a result. First, you think it's OK to ban books and are thus beyond the pale to start with; Second, either you understand the denouement of that book and don't like it because you're a racist, or you've probably internalized _White Fragility_ a bit too thoroughly and dismiss _Huck_ out of hand because it dares to have the n-word in it and have never read the denouement or realized what it means.

 _It was a close place. I took it up, and held it in my hand. I was a-trembling, because I'd got to decide, forever, betwixt two things, and I knowed it. I studied a minute, sort of holding my breath, and then says to myself:

"All right, then, I'll go to hell"—and tore it up.

It was awful thoughts and awful words, but they was said. And I let them stay said; and never thought no more about reforming. I shoved the whole thing out of my head, and said I would take up wickedness again, which was in my line, being brung up to it, and the other warn't.

And for a starter I would go to work and steal Jim out of slavery again; and if I could think up anything worse, I would do that, too; because as long as I was in, and in for good, I might as well go the whole hog._

</comment><comment><USER13> Everything I know about the book is from a Yaron Brooks podcast. He describes its worldview as one where all white people are inescapably racist by due being born white in this place and time, and that there is nothing we can do about it because it is part of our psyche. Additionally, it is not so much individual thoughts or intended actions that are to blame, but society and our institutions, that are also inherently racist whether or not there are any policies you can point to or not that indicate it. Apparently, white poeple are uncurable in this way.

Yaron's issue is that it denies individual responsibility for their wrong- headed thinking utterly; denies free will and the ability for individuals to change their minds and be decent; and finally, that by characterizing people as inherently this or that on the basis of race is itself a deeply racist approach to the topic.

Is this an accurate summary or is it mistaken?

<comment><USER14> > Is this an accurate summary or is it mistaken?

From a very quick look at the preview on Google Books, I'd say it's deeply inaccurate when it comes to the central message of the book.

> He describes its worldview as one where all white people are inescapably > racist by due being born white in this place and time, and that there is > nothing we can do about it because it is part of our psyche.

The point the book seems to lay out for itself is that awareness of the nature of racial privilege and the related sensitivity is key to enabling one to doing something about it, the exact opposite of it being inescapable. From the introduction: "If, however, I understand racism as a system into which I was socialized, I can receive feedback on my problematic racial patterns as a helpful way to support my learning and growth."

<comment><USER15> No, the central message of the book is that in order to become less racist, you need to become less white. This directly ties racism to belonging to a particular race, rather than making it a matter of individual choice and responsibility.

And even if it is still a matter for the individual, the book asserts that racism is an inherently white trait. Again, that's racist.

The book promotes far more racist ideas than it combats. Its popularity shows just how happy people are for the pendulum to swing the other way.

<comment><USER14> > No, the central message of the book is that in order to become less racist, > you need to become less white.

Assuming you have read the book and reached that conclusion based on the actual content, I'd be interested in specific support for that claim. Because while I haven't read much (again, just some of the freely-available preview on Google Books), that description conflicts with essentially every bit I have read, including the sentence I quoted from the introduction, which from reading the introduction seems to be the author's direct statement of their motivation with the book.

> And even if it is still a matter for the individual, the book asserts that > racism is an inherently white trait.

It seems to say it is a system into which Whites in the modern USA tend to be socialized into participating in in varying ways and degrees; it seems to be extremely repetitive on the point that it is a product of social context and not an inherent trait. I supposed it is possible that after the introduction the author pulls a 180° and reverses every word of the Introduction, but it seems a lot more likely that the people painting the books content as being a bunch of things that the Right has been setting up as strawmen to argue against for decades before the book was published in discussions of race are just setting up those same strawmen again instead of engaging with the content of the book.

<comment><USER13> > Being seen racially is a common trigger of white fragility, and thus, to > build our stamina, white people must face the first challenge: naming our > race.

Outside the context of this discussion, I don't think a reader could decide whether quotes like this are from a left wing anti-racism book, or a neo-Nazi pseudo intellectual

More troublesome quotes below

Why only whites can be racist:

> When I say that only whites can be racist, I mean that in the United States, > only whites have the collective social and institutional power and privilege > over people of color. People of color do not have this power and privilege > over white people.

Attributing all cultural traits to race, and then labeling everybody based on their race

> Whiteness rests upon a foundational premise: the definition of whites as the > norm or standard for human, and people of color as a deviation from that > norm.

<comment><USER15> I'm sure if you asked the author "so you're saying that racism only exists when you have power over somebody?" they would reply simultaneously "of course not, thoughts can be racist too" and "but all white people have power over black people because of the fact they are white".

The whole thing is self-defeating, and it is a tragic indictment on the state of intellectualism and academia, that a book like this can be so widely praised.

</comment></comment></comment></comment></comment></comment><comment><USER16> Writing as a non-American. All if this is horrible, but it is not just the horror of US. In my former Eastern European country, that has never ever had a sizable non-white community, people are reading these books, picking up on Twitter fights and apologizing for jokes they told on tv ten years ago. Writing a book with no mention of it being based on a particular society thus assuming the situation to be the same in Helsinki, Rome and Minneapolis, now _that's_ racist.

</comment><comment><USER17> Since roughly late 2016 the UUA [Unitarian Universalist Association] has been ever trying to "get on top of" their self-described "white fragility issue". This has caused and been a source of contention amongst many within both the UUA itself and also with UUs and UU organizations at large over the years since.

I have personal thoughts and feelings on the matter for several reasons but I won't get into them here in order to try to remain neutral in merely stating the fact that said contention exists.

For those curious, I encourage research and if it's not too much trouble or against impartiality on my part I can try to point the way to some sources.

</comment><comment><USER18> Everyone is fragile. There is no "master race" which is immune to negative emotions.

<comment><USER14> "White fragility" (the concept, not the book, which I have no opinion about and don't expect a piece leading with the false social generalizations that are straight out of right-wing propaganda that this does to provide any illumination that would help with that) isn't about special fragility in Whites, it's about the special consequences of normal human fragility has in a particular privileged elite when confronted with a challenge to that privilege, and moreover to the mythology that provides a veneer that allows them to see the world in which that privilege exists as just. In contexts other than the modern USA, there are other dominant elites which no doubt would exhibit the same effects when challenged; there's nothing _innately_ White about White fragility, it's only circumstantially White.

<comment><USER19> In fact, her own definition is (from Wikipedia):

>White Fragility is a state in which even a minimal challenge to the white position becomes intolerable, triggering a range of defensive moves including: argumentation, invalidation, silence, withdrawal and claims of being attacked and misunderstood.

You could replace the world white by any other word. And you can replace the list of defensive moves by the equivalent statement : "refusal to unconditionally comply", since it's the only option left.

I would venture a guess that this covers about 75% of human interactions, and 99% of interactions when the discussion is about challenging someone's interests or position.

</comment></comment></comment><comment><USER20> Maybe the writer suffers from exactly what the book describes.

The primary argument seems to be that we should stop discussing the lived experiences of black people and the issues they keep trying to bring up because talking about things is the real issue.

It also strips away any agency from black people by suggesting any coverage of these issues is because of the media and white liberals instead of what black people want.

</comment><comment><USER21> This is over-delicate introspection given reality that does not exist. Cultures differ, wars have been fought. This is something that either becomes overt or is sublimated successfully. Children think that understanding the underlying issue makes the problem go away.

</comment><comment><USER22> What I never understood with those concepts is what kind of society they are envisioning.

Like, if color-blindness is not even a goal anymore, how would a post-racist world look? What would be the role of whites in this world?

If "whites" don't exist anymore (not because anyone was killed but because "whiteness" is a particular socialisation and a system of privilege which will have been abandoned), what is the role of descendants of European settlers?

(I haven't read the book yet, so it may be I've fallen for right-wing strawmen in those discussions.)

<comment><USER23> > Like, if color-blindness is not even a goal anymore, how would a post-racist > world look? What would be the role of whites in this world?

I think the claim is that a post-racist world is a racist construct because white racism is indelible, and the role of whites is to subordinate themselves to the oppressed and support their goals, indefinitely, as reparation.

</comment></comment><comment><USER24> Many of us (I'm among them) who check far enough back into their ancestry will find that their 'race' is far from a given. Given our recent knowledge of genetic bottlenecks thousands of years ago, the whole notion dissolves into a mere question of self-serving bunkum.

</comment><comment><USER25> > Democratic Party leaders, pioneers of the costless gesture, have already > embraced this performative race politics as a useful tool for disciplining > apostates like Bernie Sanders. Bernie took off in presidential politics as a > hard-charging crusader against a Wall Street-fattened political > establishment, and exited four years later a self-flagellating, defeated old > white man who seemed to regret not apologizing more for his third house. > Clad in kente cloth scarves, the Democrats who crushed him will burn up > CSPAN with homilies on privilege even as they reassure donors they'll stay > away from Medicare for All or the carried interest tax break.

It's useful to keep in mind what's actually happening to people like Taibbi, Greenwald etc. For years, they've been trying to lead the class-war faction of the left - for them race was irrelevant and distracted from the actual problems, for which they had a ready made solution. These solutions, M4A, etc, didn't have to deal with race. But, this faction lost. There's not conspiracy, people just didn't want what Bernie, Taibbi, et all were selling, that's all.

The faction that did win does in fact talk about race and now Taibbi is out in the cold. But it's alright, this isn't the French Resolution, no one is coming for his head. He's just gonna have to take a back seat and wield less power. He'll be fine.

<comment><USER6> > The faction that did win does in fact talk about race and now Taibbi is out > in the cold. But it's alright, this isn't the French Resolution, no one is > coming for his head. He's just gonna have to take a back seat and wield less > power. He'll be fine.

If the dynamic you're describing is correct (not saying it is) then this conclusion is wrong. When insecure people gain power they try to disenfranchise their enemies. But they have no real power over the far- enemies. Some conservative in a conservative stronghold with conservative employees and customers can't get canceled because nobody who could cancel them is inclined to do it.

The people who get their heads chopped off (or get fired or harassed etc.) are the near-enemies, who are the easiest to sacrifice when the new regime wants to prove it can put heads on spikes, because they're at the same time close enough to be vulnerable but far enough to be targets.

</comment></comment><comment><USER26> It's insane and it leads to conservative resurgence, not only in USA but all around the world. Which then returns to USA, and so on in a vicious circle.

<comment><USER27> > It's insane and it leads to conservative resurgence

Unclear what you mean exactly. The way I interpret it, please correct me if I'm wrong, is:

       The concept of "White Fragility" is so ridiculous and overbearing that it causes white people to retreat to a more conservative stance.

In that case, I agree.

But I guess you could also mean it as:

       White people are so fragile in their identities that being forced to be challenged about their beliefs and behaviors causes them to become defensive and retreat to a move conservative position.

Which is I think exactly what the author claimed if I'm remembering the book correctly.

Either way it's sort of a "heads I win tails you lose" situation she paints, which mostly makes me not interested in playing along.

<comment><USER6> > The concept of "White Fragility" is so ridiculous and overbearing that it > causes white people to retreat to a more conservative stance.

I think this is underselling it.

The problem is that it causes "white people" to think of themselves as "white people" instead of e.g. Americans, or just People. It creates a frame where their team is "white people" and they should get together with their teammates to fight for their interests. (And, of course, the same thing for "black people" as well.)

That isn't so much "a more conservative stance" as it is a more racist stance. Describing it as anti-racist is some kind of Orwellian doublethink.

<comment><USER28> "Part of left's problem is it expects/demands blacks/hispanics to vote on ethnic basis but is appalled when whites do" ([https://twitter.com/JYDenham/status/796345533124186113](https://twitter.com/JYDenham/status/796345533124186113))

<comment><USER20> This only makes sense if you remove historical and present context. "White" people voting in their interests has often resulted in oppression of non-white people. It's really not interchangeable since one group is hoping to end oppression and the other is maintaining the status quo.

<comment><USER6> That's just assuming the conclusion.

If you stipulate that one group of people are voting to perpetuate oppression and another are voting to end it then you know who the good guys and bad guys are, but that's not how the people voting the way you don't want them to would characterize the situation.

</comment></comment></comment></comment></comment></comment><comment><USER29> So happy to see this on the front page while assange news gets flagged and vote brigaded.

So stunning, so brave.

<comment><USER30> HN has had plenty of major threads about Assange, including just a few days ago.

[https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...](https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=assange%20comments%3E20&sort=byDate&type=story)</comment></comment>


Mysterious Siberian crater attributed to methane - <AUTHOR> http://www.nature.com/news/mysterious-siberian-crater-attributed-to-methane-1.15649

<comment><USER2> Methane from thawing permafrost can act as an accelerant to global warming, and some models predict an exponential acceleration if this happens. This is not good news at all.

See [http://motherboard.vice.com/read/if-we-release-a-small- fract...](http://motherboard.vice.com/read/if-we-release-a-small-fraction-of- arctic-carbon-were-fucked-climatologist)

</comment><comment><USER3> The concentration of methane cited is above the lower explosive limit of methane in air (4.4%). Let's hope no one throws a match down this crater without filming it.

</comment><comment><USER4> I don't see how civilization as it is currently organized on this planet can exist if climate change accelerates due to positive feedback. It seems geoengineering, or rather ghoulishly, a massive die off of humans, are the only possibilities for preventing this. Antibiotic resistance may provide the latter, but I can hardly countenance it. We really need another planet.

<comment><USER5> And how would that _exactly_ benefit the 6+ billion people in the receiving end of that cringing events?

Even assuming that a suitable planet is found in a time frame that matters, and the required space travel technology is developed in a time frame that matters... how many thousands of people would we be able to send in the Colonizing ships?

That might save Humanity-the-species... Humanity-the-Actual-population would remain just as screwed anyways...

<comment><USER4> Oh it wouldn't - and I think it's 7+ now too. The vast majority would be doomed.

<comment><USER5> Precisely!!!

More over Humanity-the-Species is most likely not at risk anyways. Our ancestors went through multiple, radical and relatively rapid climate shifts during the Ice Ages, so a plausible argument can be made that some remnant of our species will get through the current round no matter what.

If this is the case, deep space travel is at this time a pretty escapist fantasy. During times of economic expansion it is harmless enough, but right now it is a dangerous diversion of limited resources. We should be focusing in two things: Mitigating the worst effects of Climate Weirding in the short term (specially with an eye towards humanitarian crisis), and Arresting the long term climate disruption through bioremediation/geoengineering. I am not even sure which one of those has the most priority.

What is very clear is that building escape probes for the rich and well- connected to escape all consequences of their own actions ranks pretty low on the list.

<comment><USER4> For what it's worth I think we're largely having an agreement. Ensuring our planet remains reasonably habitable should be the highest priority. That part of me which desires to see humanity survive even if we fail in this endeavor would like to see a backup planet (presumably Mars) at the species' disposal.

<comment><USER5> Given that Mars would be orders of magnitude harder to terraform than, well... Terra. Why do we even have to consider it?

There's no plan B. Each of us is part of The Red Thin Line (href = [http://en.wikipedia.org/wiki/The_Thin_Red_Line_%28Battle_of_...](http://en.wikipedia.org/wiki/The_Thin_Red_Line_%28Battle_of_Balaclava%29) ), whether we like it or not. The only question worth asking is: Am I going to hold my ground or not?

</comment></comment></comment></comment></comment></comment><comment><USER6> Url changed from [http://www.iflscience.com/environment/scientists-think- they-...](http://www.iflscience.com/environment/scientists-think-they-may- have-solved-siberian-crater-mystery), which points to this.

</comment><comment><USER7> Nothing to see here folks. Let's just keep on with the status quo, I'm sure we can build some epic structures to keep the ocean at bay and protect our coastal cities, keep supply chains moving, etc.

Right?</comment>


Revealed: Trump backer's spy firm used by Met Police and Cabinet Office - <AUTHOR> https://www.opendemocracy.net/en/opendemocracyuk/revealed-trump-backers-spy-firm-lobbied-gove-hancock-before-winning-key-nhs-contract/ <comment><USER2> It's not surprising that the person who encouraged police brutality[1] and is a racist[2] teamed up with the racist police.

1\. [https://www.vox.com/platform/amp/identities/2020/5/30/212755...](https://www.vox.com/platform/amp/identities/2020/5/30/21275588/trump- policing-policies-doj-george-floyd-protests) 2\. [https://www.newsweek.com/donald-trump-n-word- apprentice-1445...](https://www.newsweek.com/donald-trump-n-word- apprentice-1445854?amp=1)</comment>


Spore: Open source, Open standards encrypted VOIP client and network for Android - <AUTHOR> https://myceli.al/projects/spore-android-client?

<comment><USER2> Mycelial dev here.. full disclosure: Ive been working with guardian project on a few things including the Open Secure Telephony Network. This project and beta OSTN network are intended to test the capabilities of the telephony software available to us. It is our belief that private telephony is abundant, should be free, and ubiquitous. If you think so too, we invite you to download and test Spore... for SCIENCE!</comment>


Do not use NPM 5.7 - <AUTHOR> https://github.com/npm/npm/issues/19883 <comment><USER3> Excuse me, but what the fuck?

Looks like the line responsible checks if the npm binary is run as sudo and then uses the UID and GID of the invoking user when chowning the directory. [ [https://github.com/npm/npm/blob/latest/lib/utils/correct- mkd...](https://github.com/npm/npm/blob/latest/lib/utils/correct-mkdir.js#L54) ]

I feel like screaming, who thought this was a good idea? If I invoke something as sudo, why does anyone think it should try to detect that and do anything about it? I want to run as the user sudo has set, not my own user, _OBVIOUSLY_.

Don't try to be smart about sudo, you will break stuff.

<comment><USER4> I completely agree with you.

But in fairness, I can't count the number of times that I've needed to fix things after people treated `sudo npm` as Simon Says[1].

I'm sure they struggled a lot with that issue before coming to this solution. Was it the right solution? Absolutely not. But that's not the point I'm trying to make.

It's all too easy to tunnel vision on a particular solution. I've done it plenty of times, and I'm thankful to those who have helped me to see other alternatives in time.

[1]: [https://xkcd.com/149/](https://xkcd.com/149/)

<comment><USER5> I don't remember exactly what tool does this, but one package manager (can be homebrew but long time ago I used homebrew) warns users if you are running it as root, since it should install packages as the user.

I think npm could implement a similar strategy and educate the users how packages should really be installed.

<comment><USER6> Homebrew it is!

$ sudo brew

Error: Running Homebrew as root is extremely dangerous and no longer supported. As Homebrew does not drop privileges on installation you would be giving all build scripts full access to your system.

<comment><USER7> I really like that message. It used to be something diffr\erent, which was vague, but this actually tells you why it refuses to run as root.

</comment></comment></comment></comment></comment><comment><USER8> This is really horrific.

The idea that correctMkdir() exists at all seems to me to be so wrong-headed.

This comment from the source says a lot:

        // annoying humans and their expectations!

Good UX is an important, oft-overlooked consideration, but there is definitely such a thing as taking it too far. If your humans are expecting this level of hand-holding, it's because you've trained them to expect it by pandering to them up until now. This is the kind of problem that should be handled with good, detailed, error message display when users don't get the result they expect, not "fixing" it with over-reaching magic.

I'm not sure I'd trust anything put out by the npm team in general from hereonin if they genuinely thought creating the correct-mkdir.js file in the first place was a reasonable idea. Is it? Genuinely open to a counter- argument.

<comment><USER9> FWIW the comment you're calling out here is four years old: [https://github.com/npm/npm/blame/d3095ff20b8ea01e7fbf93a4a69...](https://github.com/npm/npm/blame/d3095ff20b8ea01e7fbf93a4a697a04fea77d8e6/lib/config/core.js#L153), before npm inc was formed.

The correctMkdir change seems more recent, but not really related to that specific comment.

<comment><USER10> This could be my inner grumpy old man speaking, but as a general rule of thumb, I look very poorly on editorializing in code comments. Originally because I didn't want my junior devs embarrassing the company when our clients received control of the code we wrote, but that also transferred into my perception of open source.

That comment should not have survived 4 years. Again, inner grumpy old man showing through.

Edit: to be clear, such comments are treated as reflective of the people and organization behind them.

<comment><USER11> I can see your point (particularly with regard to deliverables), but I suspect the practice is quite widespread - comments often end up being used as a sort of brain dump.

For instance, see this article (from 2004) on comments in the Win2k source code: [http://atdt.freeshell.org/k5/story_2004_2_15_71552_7795.html](http://atdt.freeshell.org/k5/story_2004_2_15_71552_7795.html)

<comment><USER10> That's a fair enough point, especially when directly employed working on closed source / proprietary code. You're essentially stuck in an echo chamber, and professional standards are more difficult to maintain when you don't have the whole of the world looking on.

I also imagine that the mental strain of figuring out edge cases and poor documentation in a system as complex as a windows OS would be enough to make anyone at least a little salty.

However widespread it may be, that does not me that I have to like it :D

</comment></comment></comment></comment></comment><comment><USER12> There appear to be no unit tests for their entire lib/utils folder. Which includes things like this (misguided) chown utility. [https://github.com/npm/npm/tree/release- next/test](https://github.com/npm/npm/tree/release-next/test) \- and note the lack of testing in the commit linked in the bug report.

I had an inkling that NPM was cancer, but not like this.

Yarn, by contrast, has everything you would expect of a Facebook-engineered library: [https://github.com/yarnpkg/yarn/tree/master/__tests__/util](https://github.com/yarnpkg/yarn/tree/master/__tests__/util)

Will be closely evaluating a switch to Yarn for our live apps. This is simply sad.

<comment><USER13> "everything you would expect of a Facebook-engineered library"

So it collects your personal information, even when not using it, and uses it for profit?

<comment><USER14> I don't like Facebook much, but their engineering is very good

<comment><USER15> Only when your needs align with theirs. Which, truth be told, is fairly common. But they have a tendency to ignore or give low priority to other people's needs, like certain features that don't meet "Facebook scale" or, just, documentation (see: Relay).

</comment></comment></comment></comment><comment><USER16> It's been almost 2 years since the great left-pad debacle[0]. The last major npm issue[1] was less than 2 months ago. While the underlying npm registry security issues will remain for a while (and other languages don't seem to have these issues with their package managers), there doesn't seem like there's too much I can do other than use yarn. And hope an alternative registry will appear.

Since I 'vote' with my code - this migration page has been helpful today - <USER2> I hope it will help others: [https://yarnpkg.com/lang/en/docs/migrating-from- npm/](https://yarnpkg.com/lang/en/docs/migrating-from-npm/)

It took me ~5 mins to migrate all of my code from npm to yarn. But I don't have complex CI tasks either.

I use ncu to check updates every couple of days, sometimes more frequently. To further distance myself from npm, can anyone comment on the pros/cons of github repo paths instead of package names in package.json?

[0] [https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos](https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos)

[1] [https://github.com/npm/registry/issues/255](https://github.com/npm/registry/issues/255)

*edit: formatting

<comment><USER17> Github paths can change way more easily than npm packages, users can rewrite git history + break your stuff and versioning when using it with npm is horrible. NPM also now protects projects from namesquatting and prevents you from deleting them when multiple projects depend on them.

<comment><USER18> How does NPM protect from namesquatting now?

<comment><USER19> [http://blog.npmjs.org/post/168978377570/new-package- moniker-...](http://blog.npmjs.org/post/168978377570/new-package-moniker- rules)

</comment></comment></comment></comment><comment><USER20> I just can't feel sorry for folks when I see comments like this one:

> _This destroyed 3 production server after a single deploy!_

I do think that the developers have a duty to do some testing of their software before putting out releases/updates. However, _users_ also have a duty to perform sufficient testing before they push new versions to their production environments.

In my opinion, it's kinda like losing data because you didn't make and/or test your backups. It's a really crappy way to have to learn a lesson but at least they've finally learned it -- and if they haven't, well, then maybe they will the _next_ time it happens.

<comment><AUTHOR> I am the one who reported this ;) In fact that was a single production server that I tried to reinstall 3 times before catching it was not really one of the commits that was doing this. No data was lost or connectivity (as long as you do not reboot it), you just lose any ssh connection/login.

Should I have done this on a staging server? Sure, but that does not change the fact that I would have had to rebuild the whole server there too. It is not expected that updating npm will kill the complete system it is on... It would be expected to have some deploy failure of some sort.

As previously noted, `npm update -g npm` pulls in version 5.7.0. Version 5.6 is still the latest but for some obscure reason if you have thisupdate anywhere in your deploy script you are screwed.

<comment><USER5> The real fix is to not run npm with sudo. Why would you do that in the first place? npm runs install-scripts when you fetch packages, so you basically open up root access for all the packages you download.

<comment><USER21> How is this different than running apt or yum or pacman or most other package managers as sudo?

Somebody has to install system software.

<comment><USER5> npm is not for managing system software and has not been developed as such. It's a javascript package manager. apt and pacman (and probably yum but never used so can't speak about it) have active maintainers for most packages and the mirrors are well taken care of.

npm is basically a giant array that anyone can add package to.

I'm using them both accordingly.

<comment><AUTHOR> I believe that node is installed with npm and both are installed in system directories. I think they should by default point the npm global directory to the user dir and not a system dir.

<comment><USER5> Depends on how you install them, think that's how the default install works but nvm (which I use) puts everything under user directories. Agree with your thinking though, should be changed in the default install for sure.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Good lord, when I try to follow the link I get the Unicorn error page with the message 'This page is taking way too long to load. Sorry about that. Please try refreshing and contact us if the problem persists.'

Has this issue provoked so much outrage that GitHub can't handle the constant stream of angry emojis on the issue comment thread?

<comment><USER23> I had the same issue. Internet archive link: [https://web.archive.org/web/20180222160101/https://github.co...](https://web.archive.org/web/20180222160101/https://github.com/npm/npm/issues/19883)

<comment><USER24> I can't even get to that page as it times out as well.

EDIT: I opened the original link in incognito mode and the page seemed to load fine.

</comment></comment></comment><comment><USER25> Apart from being a horrific bug, why are people running npm as root? Why don't they install it somewhere below $HOME and modify $PATH? npm is working fine without root permissions.

Everything is super dangerous as root, one should avoid using root at all costs until there is no other way.

<comment><USER26> `sudo npm install -g` is one of several examples of the normalization of deviance rife in the NodeJS community. Most command-line utilities distributed through NPM recommend running as root (implicitly—because they all suggest installing it as a global package). Here's[1] Microsoft's instructions to install the TypeScript compiler, for example.

NPM's awfulness notwithstanding, it's trivial to write a shell script to do what you say and add a symlink to ~/bin. But everyone on StackOverflow will tell each other "just run it with sudo", and they do, and then quickly move on with their lives (presumably to be followed with "and break things"). Instead of doing the right thing, raising their hackles about how poorly NPM is designed, and holding its community leaders accountable.

1\. [https://github.com/Microsoft/TypeScript/blob/b29e0c9e3ab2471...](https://github.com/Microsoft/TypeScript/blob/b29e0c9e3ab247199eed6b69674a2c992c3a05a6/README.md#installing)

<comment><USER27> If I run npm without -g, it complains about missing files, and fills my home directory with node_modules junk and a package-lock.json I have to "commit"? Why do I want to commit it, and where?

I'm sure you are now going to tell me there is an easy way to fix that too, and I'd be happy if there was, but for me I just want to use npm to install a program or two.

<comment><USER28> The correct way is to use `npm install -g --prefix` to install it into a directory on your path which is writeable by your current user.

I don't think I've ever seen the install instructions for a npm-packaged tool actually say to do this.

<comment><USER27> Thanks, I'll give that a try in future.

</comment></comment></comment></comment></comment><comment> master-litty [http://blog.npmjs.org/post/171169301000/v571](http://blog.npmjs.org/post/171169301000/v571)

      Thankfully, it only affected users running `npm@next`, which is part of our staggered release system

      #STOPUSINGPRERELEASEWITHSUDO

Really now?

      #ANGRYORANGEWEBSITE #PEOPLEGOTMAD

:)

<comment><USER29> This is just absolutely unprofessional.

All tags:

#ANGRYORANGEWEBSITE #PEOPLEGOTMAD #STOPUSINGPRERELEASESWITHSUDO #CLIHOTFIX #WEGOTUBB #LITERALLYKILLEDGITHUB

Author:

FEBRUARY 22, 2018 (9:53 AM) @MAYBEKATZ

[https://web.archive.org/web/20180222201315/http://blog.npmjs...](https://web.archive.org/web/20180222201315/http://blog.npmjs.org/post/171169301000/v571)

</comment></comment><comment><USER30> Reminds me of a recent Yarn problem, overwriting which(1). [https://github.com/yarnpkg/yarn/issues/4205](https://github.com/yarnpkg/yarn/issues/4205)

<comment><USER31> Both of these issues seem like a timely reminder that everyday Linux desperately needs a proper application management and security model.

Installing software where your options are

1\. running as a regular user, and the install script can put whatever it wants within your user's directories

or

2\. running as root, and the install script can do literally anything to anywhere on your system

is not fit for purpose, when the risks from both malice and incompetence are both reaching new heights almost daily.

These are systems we use for real work, but even smartphones and their toy app stores do better now. How do we still not have controls so applications can always be installed/uninstalled in a controlled way, can only access files and other system resources that are relevant to their own operation, and so on?

<comment><USER32> > everyday Linux desperately needs a proper application management

You mean something, that won't allow two packages to own the same file? Something, like, rpm or apt?

<comment><USER33> You probably meant rpm and dpkg... Or you'd have to compare yum, zypper, apt, pacman and whatever else is out there.

But, I'm certain the parent didn't mean that. Dpkg and rpm both allow packages to overwrite files from each other and, more dangerously, allow fully authorized post-install scripts. And they're often necessary for sane package management (create user, initiate database), but could be exploited to wreck havoc on the system.

<comment><USER32> Yes, I meant dpkg.

Not sure about dpkg, but rpm does not allow two packages to own the same file. If you try to install package, that contains file owned by another, already installed package, the installation will fail (you can try that with installing an amd64 package that owns something in /usr/share, and then try to install the i386 version). Yes, post-install scripts are dangerous and rpm folks are doing small steps to phase them out: [https://www.youtube.com/watch?v=kE-8ZRISFqA](https://www.youtube.com/watch?v=kE-8ZRISFqA)

<comment><USER34> dpkg will throw a fit in the same way.

<comment><USER33> it will throw an error message, which the user is probably going to ignore and install anyway.

This will ultimately cause errors down the line. Maybe not right now, but eventually problems will occur.

showing a warning is great, but not needing that warning would be preferable.

but most distributions are already working on solutions to that. ubuntu is working on SnapOn's [0] for example, and i remember hearing about something else from redhad as well.

[0] [https://snapcraft.io/](https://snapcraft.io/)

<comment><USER35> No, it will not install the package at all:

        $ mkdir root/bin/
        $ (echo '#!/bin/sh'; echo 'echo "hi"') > root/bin/ls
        $ chmod +x root/bin/ls
        $ fpm -s dir -t deb -n bad-ls -v 1.0 -C `pwd`/root .
        Created package {:path=>"bad-ls_1.0_amd64.deb"}
        $ dpkg-deb -c bad-ls_1.0_amd64.deb
        drwxrwxr-x 0/0               0 2018-02-22 10:44 ./
        drwxr-xr-x 0/0               0 2018-02-22 10:44 ./usr/
        drwxr-xr-x 0/0               0 2018-02-22 10:44 ./usr/share/
        drwxr-xr-x 0/0               0 2018-02-22 10:44 ./usr/share/doc/
        drwxr-xr-x 0/0               0 2018-02-22 10:44 ./usr/share/doc/bad-ls/
        -rw-r--r-- 0/0             142 2018-02-22 10:44 ./usr/share/doc/bad-ls/changelog.gz
        drwxrwxr-x 0/0               0 2018-02-22 10:44 ./bin/
        -rwxrwxr-x 0/0              20 2018-02-22 10:42 ./bin/ls
        $ sudo dpkg -i bad-ls_1.0_amd64.deb
        Selecting previously unselected package bad-ls.
        (Reading database ... 837129 files and directories currently installed.)
        Preparing to unpack bad-ls_1.0_amd64.deb ...
        Unpacking bad-ls (1.0) ...
        dpkg: error processing archive bad-ls_1.0_amd64.deb (--install):
         trying to overwrite '/bin/ls', which is also in package coreutils 8.28-1
        Errors were encountered while processing:
         bad-ls_1.0_amd64.deb
        $ ls -l /bin/ls
        -rwxr-xr-x 1 root root 134792 Oct  2 10:51 /bin/ls*

It doesn't just warn and leave things in a bad state.

<comment><USER33> this is strange. I encountered a conflict at work recently with an /etc/ file conflict.

the stdout of the dpkg errormsg gave me the required tag i could use to do it anyway. it was basically just

      !! double click -> middle click

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER36> Doesn't really surprise me when you have other issues like this ([https://github.com/npm/npm/issues/17929](https://github.com/npm/npm/issues/17929)) that have persisted for a long time. NPM 5.x in general hasn't been very stable.

<comment><USER31> _NPM 5.x in general hasn 't been very stable._

Indeed. Another odd thing that it's been doing lately is when I run some NPM scripts on one of our machines, it starts shouting about some sort of update not working (why was it updating anything at all just because I ran `npm run something`?) and gives me instructions on how to fix it from the Linux shell (on a Windows box). The depth of failure implied by that message is disturbing on several levels.

</comment></comment><comment><USER37> Wow the toxicity on that thread is appalling. I feel like I need to a tool when hiring people that automatically shows me their github comments with the most reactions.

</comment><comment><USER38> Wayback link, of someone has a better mirror please post: [http://web.archive.org/web/20180222170341/https://github.com...](http://web.archive.org/web/20180222170341/https://github.com/npm/npm/issues/19883)

</comment><comment><USER39> From: [https://github.com/npm/npm/releases/tag/v5.7.1](https://github.com/npm/npm/releases/tag/v5.7.1)

 _" Thankfully, it only affected users running npm@next, which is part of our staggered release system, which we use to prevent issues like this from going out into the wider world before we can catch them. Users on latest would have never seen this!"_

If you are updating to the latest pre-release of something within mere _hours_ of it dropping and you are updating production systems (presumably that have some business value) with no previous testing then the consequences of that aren't on the devs they are 100% on you. And you don't deserve to call yourself an IT (or Ops or DevOps or what-have-you) professional, that is amateurish behavior in the extreme.

</comment><comment><USER40> My personal opinion is that the root cause of the issue is the ability of a _language_ pacakge manager to mess with system files at all (i.e. do a global install of anything). Shards, the crystal package manager makes the sensible design decision to only install libraries into `$PWD/lib` and binaries into `$PWD/bin`. Everything is local only to your project. If you want a binary on your PATH, you can create an installation method that works for your commandline tool's specific usecase. Hopefully a distro/homebrew package.

I wrote about this in longer form here: [https://github.com/crystal- lang/crystal/pull/3328#issuecomme...](https://github.com/crystal- lang/crystal/pull/3328#issuecomment-247970222).

</comment><comment><USER41> npm is one of the few tools that I am afraid to have on my Laptop, Because unlike most tools I have used, When npm does something wrong, It'll ruin not just itself but a lot more directories on my pc which is annoying to fix.

</comment><comment><USER42> Oh well, I remember fondly that one time I had an important deadline whooshing by (with that lovely sound Douglas Adams knew) and I happened across this cute little bug:

[http://appleinsider.com/articles/09/10/12/snow_leopard_guest...](http://appleinsider.com/articles/09/10/12/snow_leopard_guest_account_bug_deletes_user_data)

(Yeah, it's _that_ much-vaunted Snow Leopard.)

I do remember scrambling to recover my backups. Back then, I didn't make full- disk backups, so I had to assemble my user folder from various places. Everything else that transpired that night and the day after remains a haze.

</comment><comment><USER43> Why do people feel the need to update especially on production servers? Shouldn't production servers be updated only when necessary?

<comment><USER44> Good question. You would think that some people would have QA/pre-prod servers with a pipeline that would catch this.

</comment></comment><comment><USER45> I find it interesting that nobody noticed this before public release. And apparently this version is a pre-release? But that isn't specified on the blog post?

<comment><USER34> And even worse, 5.6.0 to 5.7.0 is, by semver, one minor point release to another minor point release - no breaking changes, no major bugs. 5.7.0-pre would raise some flags.

<comment><USER46> Uhh. Does semver actually say anything about _bugs_?! o_0

<comment><USER47> I'm pretty sure you don't release pre-release versions without -pre or -beta or -rc tags in the end.

<comment><USER48> Technically you don't _have_ to with semver, it's just a good practice. From [https://semver.org/](https://semver.org/):

> A pre-release version MAY be denoted by appending a hyphen and a series of > dot separated identifiers immediately following the patch version.

Note that it says "MAY" and not "MUST", so it's optional.

</comment></comment></comment></comment></comment><comment><USER49> As a semi-outsider to the frontend and node development worlds, it continues to surprise me that a viable alternative to npm still hasn't come along. Not trying to pile more hate on npm, but there's been many years of complaints about instability, horrid UX, bad security model, user hostility, etc. Yarn was just a first step. If there was a system with half the features, but made sense and was secure I think the community would shift very quickly.

<comment><USER50> Yarn is actually a very good alternative to the NPM cli. While there has been some issues on the package hosting side as well, by far the biggest issues were/are on the client side, and practically a of them are solved by Yarn.

</comment></comment><comment><USER15> I swear NPM has some absurd showstopping bug every month.

With something that has as many people using it, it's just... I dunno, it's disheartening.

Edit: oh well, this was a @next release only. Not as bad. Still scary.

</comment><comment><USER51> I really wish node would ship with Yarn instead of NPM. Every serious js project these days already uses it.

<comment><USER52> Does yarn run npm behind the scenes? Or does it even replicate the bugs in its attempt to be fully compatible? I used yarn to install global packages and see the packages in `/usr/lib/node_modules` with the permissions of my user rather than root.

<comment><USER53> yarn use npm registry behind the scene.

</comment></comment></comment><comment><USER54> CI/CD does not mean deploying code to production by fetching source code from GitHub onto a server used by your customers and then compiling or downloading NPM dependencies.

That is a recipe for disaster.

</comment><comment><USER55> Looks at correct-mkdir. Sees "cb = dezalgo(cb)". [https://www.npmjs.com/package/dezalgo](https://www.npmjs.com/package/dezalgo)

"Contain async insanity so that the dark pony lord doesn't eat souls"

Just... What. I feel like when you need to reach for tools to "contain insanity", you might want to backup and ask someone who has written to a filesystem before... The linked blog about "preventing the release of Zalgo" and the linked [https://blog.ometer.com/2011/07/24/callbacks-synchronous- and...](https://blog.ometer.com/2011/07/24/callbacks-synchronous-and- asynchronous/) seem completely erroneous. The entire point of callbacks is to _surrender_ control to a function - here is a piece of code to run when you are ready - now, sometime, or never, or maybe many times, as you see fit. Waiting until the next process tick seems so completely unnecessary... This strikes me heavily as "a solution in desperate search of a problem" \- although I have that feeling with a _lot_ of NodeJS code I read...

The author of the blog linked on the dezalgo project seems to, at the end of the post, imply the purpose is for performance? By deferring work until a later date?

"The basic point here is that "async" is not some magic mustard you smear all over your API to make it fast. Asynchronous APIs do not go faster. They go slower. However, they prevent other parts of the program from having to wait for them, so overall program performance can be improved."

Other parts of the program _other than the work we've asked it to do_? What if we're only "correctly making" one directory? So we intentionally make our code slower... So that "other code" can run? He continues:

"This makes the API a bit trickier to use, because the caller has to know to detect the error state. If it's very rare, then there's a chance that they might get surprised in production the first time it fails. This is a communication problem, like most API design concerns, but if performance is critical, it may be worth the hit to avoid artificial deferrals in the common cases."

So it's slower -and- more complicated, and we're gonna hide it behind a meme. Gotcha.

<comment><USER56> Deferring until next tick is one way to get around call stack problems. If you create a really big series of callbacks which will call other callbacks which call other callbacks... you can run out of call stack.

The other issue is let's say you have some code like...

        var f = 1
        doSomeOperation(function done(){
            console.log(f)
        })
        f = 5

If doSomeOperation calls done() sometimes syncronously and sometimes asynchronously, it will sometimes log 1 and sometimes log 5. If doSomeOperation always works one way it's more consistent. It's not a perf thing it's just consistency.

</comment></comment><comment><USER57> I wish fixing of npm global directory permissions was part of the npm install page ([https://docs.npmjs.com/getting-started/installing- node](https://docs.npmjs.com/getting-started/installing-node)), or mentioned at least. My first few npm setups always left me in permissions hell as I'd just use the install page, ignoring the next steps.

</comment><comment><USER58> [https://www.dayssincenpmbroke.com/](https://www.dayssincenpmbroke.com/)

accepting PRs: [https://github.com/Ashtonian/dayssincenpmbroke.com](https://github.com/Ashtonian/dayssincenpmbroke.com)

<comment><USER59> Do you really need google analytics for this?

<comment><USER58> need is a strong word. Do I need the entire site - no. The mentality was more like "oh haha joke site?.... I wonder how many people are actually looking at the site and from where.. man I wonder if there is a solution for that... oh right google analytics."

<comment><USER59> > I wonder how mwany people are actually looking at the site and from where.. > man I wonder if there is a solution for that... oh right google analytics.

And I wonder if it's possible to make a 2 dollar website without tracking your users or reporting to google.

I expect most people who dabble with technology use an adblocker anyway which blocks requests to google analytics.

I wouldn't mind a self hosted analytics solution, but with all the captchas and the mails, I feel we give google enough information as it is.

<comment><USER58> wellllllllll when you make a website as a joke you can choose which if any analytics solution you want. And deal with the critics that use analytic blockers to complain about your analytics solution.

The site collected 10k visits over 3 days from around the world.

</comment></comment></comment></comment></comment><comment><USER60> A user of NPM that needs to use `sudo npm` simply did not properly install nodejs into the user directory. NPM is packaged with the node version you are running. So if you installed node with a root user or in a directory that requires root user access you will need to sudo to use `npm`. But if you properly install node under your user you will never have an issue. Anyone that does `sudo npm` did not install nodejs under their user. This may be confusing to people because a lot of tutorials tell you to use `sudo npm`. NPM is a piece of software that is consumed by millions of people and different devices. It is crazy to think there will be no side effects to how people use something where it was not designed.

</comment><comment><USER61> Running npm as root is bad, either install the npm package from your distribution (apt, pacman...) or, to use `npm install -g` edit `.npmrc` add `prefix=/home/<me>/.node` in it, and add `~/.node/bin` to your path.

<comment><USER51> It's bad, but at the same time it's hard to blame people doing it too much when it's literally in the npm documentation: [https://docs.npmjs.com/troubleshooting/common- errors](https://docs.npmjs.com/troubleshooting/common-errors)

<comment><USER61> I am not blaming people, maybe my comment wasn't formulated properly. What I meant is "don't do it, there is an alternative".

I think no documentation should ever include sudo in their commands. You should put a note "depending on your environment, some of those commands might require root privileges" or something.

</comment></comment></comment><comment><USER62> Reading this and the comments here really makes me feel sorry for the npm people.

If you are reading this: You are doing great work, I wish you the energy and strength to ignore the trolls.

</comment><comment><USER53> Switching to yarn is not going to fix this. However, this raise some concern about npm cli

\- we are relying on 2 people team for our applications. \- maintainer doesn't seem to care much about this horrific bug: [https://imgur.com/a/v4Ndb](https://imgur.com/a/v4Ndb)

<comment><USER63> > Switching to yarn is not going to fix this.

Yeah, but if you had switched to yarn beforehand, then you would not be facing this issue.

<comment><USER53> iirc yarn has a bug regarding `which` cli which is similar to this.

bugs are bound to happen and it's part of software development. however, the team size of npm cli and the way they react to this incident are what make me concern more.

</comment></comment></comment><comment><USER64> About a week ago, I attended a tech talk by a Google employee, a senior position, who said, if I remembered correctly, that their testing effort uses the most of their hardware resources at entire Google. Software testing can be difficult and challenging, but it is a critical part.

</comment><comment><USER65> Why would reporter run sudo npm???

<comment><USER66> sudo yum sudo apt-get sudo pacman

Why wouldn't you naively assume sudo npm was safe if you wanted a global package (I know the behavior of npm...)

This is blaming the victims. If the user can blow their foot off, its not the users fault.

</comment></comment><comment><USER62> Title should be changed to 5.7.0 as newly released 5.7.1 fixes the bug.

<comment><USER67> Maturely tagged with `#STOPUSINGPRERELEASESWITHSUDO`

When their Official Blog makes no mention of 5.7.0 being a prelease [0] and is semantically versioned as a stable release. The thread also later details that running `npm upgrade -g npm` instead of `npm install -g npm`will get 5.7.0 instead of 5.6.0 [1].

Is it standard practice for an `upgrade` command to pull a pre-release or beta? When I upgrade Firefox I don't get put onto the Nightly branch...

[0] [https://vgy.me/LkvBKS.png](https://vgy.me/LkvBKS.png)

[1] [https://github.com/npm/npm/issues/19883#issuecomment-3677268...](https://github.com/npm/npm/issues/19883#issuecomment-367726819)

<comment><USER62> This is relevant to the information I posted in my comment here how?

It is not.

</comment></comment></comment><comment><USER52> I just looked at my /usr/lib/node_modules directory and it's No man's land in there and I'm on npm 5.6.0. How could this go unnoticed for so long?

</comment><comment><USER68> Destroyed my local packages. Can't resist to yarn anymore. Switched.

</comment><comment><USER69> Remind me again why there are language specific package managers...</comment>


A social Experiment - <AUTHOR> My name is Hamza Rehman. I am a startup founder, and passionate about technology, innovation and product development. I believe in leaving a legacy and making a difference on a mass scale, and startups are where I get to explore that side of me.
I, along with my team, have been exploring the side of millennial population for the habits of donating to charities. We have developed a product where user can compete on their daily steps by pledging a dollar for the charity of their choice and invite their friends to the competition. We are calling it a social fundraising platform.
For more information; www.Stepp.io
There is a huge mistrust among the millennial market (including us) due to the lack of transparency inside these big organizations. We are trying to learn what motivate people to donate to these charities.
Please, help us run a successful beta of our product and give us some feedback. App is available in the app store;
https://itunes.apple.com/us/app/stepp/id1014866950
We appreciate your time and support.
Regards,
Step'p Team <comment><USER2> I like the idea. Here's a thought:

There are a few sites out there which rate charities on where donated money goes. Research those and convert the percentages into steps - for example, if you take 10000 steps a day, and your charity runs a 10% administration overhead, then your first 1000 steps go to the charity, the rest go to the people the charity should be helping (and if you are making profit from your app, tell them how many steps you guys are taking). This may help you with the motivation issues.

I can't check your app as I'm an android user, but could you add a cooperative mode? Rather than compete against your friends, why not pool your steps together? Competition could be added to this through a co-op leaderboard. Also, lazy bastards like me could sponsor teams ('I'll give you $10 if you hit a million steps with your friends') This could open up interesting things like a whole company 'stepping' together, the you could have Google vs Facebook step contests for charity.

Good luck on your venture!

<comment><USER3> Those are all great ideas, especially with the cooperatives and the team sponsors.</comment></comment>


Membrane Framework – An Elixir framework for multimedia streaming applications - <AUTHOR> https://www.membraneframework.org <comment><USER2> This looks very good and will be interesting to see how it scales in a large cluster - should be possible with it being written in Elixir to scale this out quite well. I'll also be interested to see how stable the NIFs are, I'd feel much more confident they weren't going to crash the VM if they were written in Rust.

<comment><USER3> Good point. Whats the point of using the Erlang VM if your NIF could bring down the whole VM. How is this different from using any other language like Go then to implement this platform?

The approach confuses me because there is so much praise for the Erlang VM but to get all its benefits of the Erlang VM they need to use ports. (Which they confess is going to be slower).

<comment><USER4> We're thinking about adding an abstraction layer over C code that will allow to switch between NIF and port backends. Ports have their limitations so you won't be able to use them e.g. for passing GPU buffers but they will do the job for many other cases.

Anyway even with NIFs we delegate to them only code that cannot be written in Elixir or it really makes no sense to keep it in Elixir e.g. in performance reasons. Even if 30% of the framework will be in C it's way easier to manage 30% of C code than 100% of C code.

Moreover, all the hard stuff, such as parallelism, being able to inspect running state of the VM, ability to spread app over cluster, I/O scalability, being multiplatform etc. comes out of the box with BEAM VM. There are many things that are give the point of using Erlang VM even if part of the code is in C and is potentially dangerous.

<comment><USER3> Thanks for your reply. The BEAM VM is amazing (and I'm a fan of Elixir) but I'm trying to see what benefit you're getting out of BEAM if you're using NIFs. Because the moment you use NIFs then your VM can crash (without recourse to the various recovery mechanisms of the BEAM) just like, say, a Golang executable.

If you used Golang you would also get parallelism, I/O scalablity, multiplaform capability... all the things you list as advantages for BEAM. The only thing that BEAM is giving you "extra" vs, say, Golang is the ability to spread your app over a cluster easily. But again, I'm sure you can achieve that with some sort of a load distributer if you used Golang on multiple machines. Also with Golang it is easy to do CPU intensive tasks because its "closer" to the metal. So I guess what I'm saying is that for your specific use case (that involves a lot of media related CPU intensive work like video/audio processing) I wonder if the BEAM VM will give you that many advantages. With Golang in this case I think you can get the scalability, reliability as your current setup with one big advantage: better performance. But this is just my ~5 min view of the subject...

<comment><USER4> Hello,

I evaluated Go at the very beginning and after making proof of concept I decided to stay with Elixir.

One of the reasons was that Go has garbage collector that can "stop the world" which is really not acceptable in some low-latency applications. BEAM VM does GC per erlang process.

Secondly, significant chunk of such framework is about interoperability with C as there're tons of libraries we're going to wrap around. cgo essentially requires developer to reimplement in definition of every single structure and function we're going to ever use. It's a massive overhead (not in sense of computational overhead but time spent).

NIFs are way simpler, there just regular C code you can link with libraries without any overhead. Remember that in such framework we're going to do quite o lot of pointer arithmetic and having plain C code is a huge advantage.

All that together allows us to have greater flexibility on how to design C layer. cgo binds us to a particular solution that is not really well designed. With Elixir we can even write C code in Rust as was suggested in another comment.

Please remind that what is really computationally expensive will be often written in C/C++ anyway or done by GPU. Framework does not add that much overhead in macro scale, it's often just a glue and abstraction layer.

And finally, if you read our goals, we clearly state that if we have to make a tradeoff, we put reliability over performance. The motivation to start Membrane was that while designing broadcasting systems we struggled to achieve true 24/7 availability with existing frameworks. You can't compare 20+ years of Erlang development in this area with Go. I mean both maturity of the VM, as well as battle-tested design patterns, built-in supervision, hot upgrades and so on.

Go is cool, trendy and has very loyal user base but it's not free of caveats.

<comment><USER3> Thanks again for your detailed response. I was curious to know why you choose BEAM because Golang vs BEAM is often a genuinely confusing option. Thanks for your insights on NIFs.

Additionally, as someone in this thread has already pointed out, it is also a matter of taste and preference on choosing Elixir over Golang.

A point about Elixir macros -- I think you will find that while macros increase your productivity, they make debugging the code a bit more difficult.

Wish your project best of luck. The website looks slick!

</comment></comment></comment></comment></comment></comment><comment><USER5> I'm trying to wrap my head around what I might use this for.

I imagine the following scenario:

* I have 3 source audio/video feeds

* I need to follow a pipeline along the lines of:

\-- ingest the source feeds

\-- stitch segments from the sources together into an output stream following some business rules

\-- extract metadata from the source (e.g. speech-to-text)

\-- transmux/re-encode the output to different renditions (bitrate/resolution combinations)

\-- Output the rendtions and metadata

Is that a reasonable understanding of what this framework is meant to enable?

<comment><USER4> Exactly.

</comment></comment><comment><USER6> I absolutely love the design...

<comment><USER7> On a mobile phone it is not so great. A single scrolling page like the recent hype but the menu disappears when scrolling down forcing me to scroll all the way back up to select the next menu. Never understood those designs. Keep my menu and home button in my screen at all times please.

P.s. I know there is a little arrow that does an animated automatic scroll upwards but for me needing such a thing is a clear indication of a flawed design. Instead of fixing the symptom you should fix the root cause..

<comment><USER8> That's not an indication of a flawed design.

Displaying the menu and home icon on screen at all times, comes with trade offs such as:

\- less screen space available for other items

\- implementation difficulties with floating fixed icons

\- distraction from content

\- overlap with on-page elements

And that's just what I can think of at 6am, pre-coffee. I would imagine the actual team has dozens of reasons behind their choice.

To _choose_ not to do so is _design choice_ , taking into account the entire situation.

Now you as a single particular end-user may not agree with their choice, but that's not a universal "flaw", but the essence with compromise in general--- someone will lose out and be unhappy.

<comment><USER7> Sorry, should have been more clear. I meant easily Accessible at all times. Usually that is all solved by making the menu disappear when you scroll down but appear again when you scroll up. Also fixes all your listed issues.

Making the navigation menu not easily accessible at all times, where I count having to scroll up 3 pages not easily accessible, is a design flaw to me. Note that my first comment also mentioned to _me_, but that may have been missed before the first coffee went in :).

</comment></comment></comment></comment><comment><USER9> Looks interesting, but the docs are quite lacking currently, so I'm not too sure what its current capabilities are :)

<comment><USER10> I think this is the 0.1 release, so I assume there's a lot of improvement coming.

<comment><USER4> There are 5 developers working hard on 0.2, stay tuned :)

</comment></comment></comment><comment><USER10> I'd been wondering about the best way to handle that with Elixir

</comment><comment> a-dub Reminds me a bit of Flumotion which is a very similar idea with the very high level language being Python instead of Erlang/Elixir.

</comment><comment><USER11> Who said nothing good can come from ICOs?

I love when OSS projects reusing ICO templates;)

</comment><comment><USER12> Tbsvj Turn off your brothers PlayStation but you can still turn it on

</comment><comment><USER13> Is this a Kurento alternative?

<comment><USER14> It's more like a smaller and more modular alternative to Gstreamer.

</comment></comment><comment><USER15> What's the minimum latency broadcasting one WebRTC stream to many clients real-time?

<comment><USER4> Can you share more details about the pipeline generating the stream? There're many factors that can increase latency.

<comment><USER15> Well so far it's a setup where the broadcaster is an iPhone and the listeners are iPhones as well. Strictly one-way. Using the default iOS and WebRTC libraries. The critical factor is that all listeners get the same data at the same time with as little latency as possible. I have been experimenting with a one-to-many setup using Janus, but I'm not sure how well that will scale up.

<comment><USER16> Each listener iphone will almost never get each stream chunk at the same millisecond, but it can be close enough most of the time, depending on your use case.

<comment><USER15> I understand that after sending the packet it still has to deal with network speeds, but the idea is that there is no buffer just mirroring all of incoming video real-time.</comment></comment></comment></comment></comment>


Hacking google street view - <AUTHOR> http://diddling.blogspot.com/2008/01/hacking-google-street-view.html <comment><USER2> Two street-view camera cars are based around the block from me in Mountain View. I talked to the guy running them, asking about what sensors besides GPS and cameras are used. He couldn't go into details unfortunately.

Ironically, the house isn't visible from street views. The house number is only approximate [http://maps.google.com/maps?f=q&hl=en&geocode=&t...](http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=150+Escuela+ave,+Mountain+View+94041&sll=37.399815,-122.092223&sspn=0.007151,0.012939&ie=UTF8&ll=37.401844,-122.092223&spn=0.007151,0.012939&z=17&iwloc=addr&om=0&layer=c&cbll=37.400882,-122.091575&cbp=1,565.8592342344413,,0,3.3530607281421636)

Whenever I see those vehicles, I give a huge thumbs up and smile, and record the spot, hoping to kickstart a modeling career by sending recruiters links to the gmaps page that shows my flailing like a baboon.

</comment><comment><USER3> Cool. Reverse engineering at its finest.</comment>


What Did You Get in Trouble for at Your School's Computer Lab? - <AUTHOR> https://gizmodo.com/what-did-you-get-in-trouble-for-at-your-schools-compute-1827590514 <comment><USER2> I found it hilarious that someone else installed "snood" I'd completely forgotten about that game until just then.</comment>


Using the sed Editor - <AUTHOR> http://www.oracle.com/technetwork/articles/dulaney-sed-098420.html

<comment><USER2> A cool little feature to vi also is the inclusion of sed-like commands...

:%s/someword/some-other-word/g

is a valid command to exchange the words throughout your current file in the same way you would with sed.

Also to note is that the use of '/' is not required explicitly. You'll often end up building fences when you have to terminate a lot of characters when you're working with paths in commands like:

s/\/usr\/opt\/dir\//\/var\/opt\/dir\//g

Instead you could pick a different terminating character and simplify it for easier reading:

s_/usr/opt/dir/_/var/opt/dir/_g

</comment><comment><USER3> I almost exclusively use

      perl -pi -e COMMAND

instead of sed for stream processing. I also use grep --perl-regexp in most cases. I need to remember Emacs and perl regex semantics; I'd rather not have more variants to remember.

<comment><USER4> And just like sed -i, perl -i supports adding a backup extension. Also you can get awk-like perl by using -a, for example:

      perl -nale 'print $F[1]' # note fields start at 0 unless you change $[

You can also make grep, but it's a bit long

      perl -ne 'print if /foo/'

</comment></comment><comment><USER5> It is a fairly comprehensive reference and all, but saying 'sed Editor' is just as bad as saying 'ATM machine'.

<comment><USER6> This is different, as sed is the proper name of the program (and just happens to be an acronym as well.) awk, while also being a stream editor, is not "a SED".

Anyway, complaining about redundant use of acronyms is IMO pointless and needlessly prescriptive. Language is a fluid thing.

<comment><USER7> > redundant use of acronyms

RUA.

</comment></comment></comment><comment><USER8> sed deserves a lot of love, I still prefer it for a lot of command-line munging, greps everywhere, bit of awk thrown in. That despite the fact that (say) perl -pe might do a more comprehensive or efficient job as basically a drop-in replacement with benefits.

Does/should a UNIX course nowadays bother training up students on these microprogramming languages if they're almost certainly going to have perl or python available anyway? They only marginally fit into the UNIX philosophy, so is it just their old-school cred that keeps them around?</comment>


Reading Design - ms-rm http://alistapart.com/article/readingdesign

<comment><AUTHOR> I liked this article but it sort of ignores the school of graphic designers who dared to write copy. Three good examples of this would be Bob Gill, George Lois and later Tibor Kalman. In fact not only would these designers write copy, but they'd often come up with the larger concept itself.</comment>


Walgreens, CVS test teeth straightening, cleanings in some stores - <AUTHOR> https://www.cnbc.com/2019/01/29/walgreens-cvs-test-teeth-straightening-cleaning-in-some-stores.html <comment><USER2> "The teeth-straightening market has become extremely competitive since 40 of market leader Invisalign's patents expired in October 2017. SmileDirectClub and a slew of other start-ups, such as Candid Co., are jockeying to overtake the teeth-straightening market, appealing to consumers with flashy marketing and less expensive treatments."

Anybody know of any other medical treatment patents that are expiring soon?

<comment><USER3> I have somewhere a huge list of patent expiration for medicines in the US for the next 5-10 years.

<comment><USER4> Where is it?

<comment><USER3> Here is one document. [https://www.pti-nps.com/nps/wp- content/uploads/2017/04/NPS_D...](https://www.pti-nps.com/nps/wp- content/uploads/2017/04/NPS_Drugs-Coming-Off-Patent-by-2022-Web.pdf)

Second one I can't find a public link anymore. Its titled "Anticipated Availability of First-Time Generics"

Here is a third one I've just come across. [https://www.goodrx.com/blog/drugs- going-generic-2018-2019-20...](https://www.goodrx.com/blog/drugs-going- generic-2018-2019-2020-2021-2022/)</comment></comment></comment></comment>


Ask HN: Why is our eCommerce store converting poorly? - <AUTHOR>

www.Morebrownies.com has been live for about a week now and we have been getting great feedback on our concept. We've had a few blogs write about us, generated thousands of unique visitors and taken a number of orders, but our conversion rate is terrible.  Far less than 1% of our visitors have placed an order.  What in your opinion are we doing wrong?  Is there something specific on our site that turns you off from ordering? <comment><USER2> I'll qualify myself by saying I've done a lot of ecommerce, roughly $1.5M on my own ecommerce stores over the last few years.

Also, I am probably your target customer. Married, 3 kids, gift giver.

At first glance, great idea and great execution. I like the design, and the concept seems to make sense. It gives you a sort of "aha, that is smart" moment. I felt like you need to move your Get Started button under the 1-2-3 steps, where I actually decided I wanted to get started.

In addition, the gift choices look like good ones. Limited choice, high quality, decent value for the price.

Now let me tell you why I probably won't convert, and maybe you can apply this to other customers: I naturally feel inclined to put this decision off until later. The idea of making these choices now and forgetting them in a few weeks is a bit scarry. Will I remember what she's getting on V-day? Birthday? What if I find another great present later and buy it, then this seems like an awkward side gift? Could I get a better deal if I just pick these up at a florist myself? The jewelry seems pretty inexpensive, is it any good? Ahh I think I should just put this off. Too much thinking when the deadline is so far away.

</thoughts>

So, I don't want you to respond to these thoughts, but consider what they mean for the business and your conversion rate. The best way to increase conversion is to understand the target customer.

<comment><AUTHOR> This was very helpful. I agree that there are a lot of decisions to be made that don't seem necessary for something so far in advance. That may be a tough nut to crack. I'm going to dig into this more and see if the feedback is consistent.

<comment><USER2> Great response, and good luck! If it helps, I would be interested in getting reminded that you have these products closer to the actual dates I need them.

</comment></comment></comment><comment><USER3> One problem might be you seem "too new" to trust to give money to, and the site doesn't have the following 'signals' that will help someone trust you ... (the site could just be a shell designed to siphon credit card numbers from folks ...) \- no customer service page with email address or method for inquiries \- generally no contact info that includes legal company name, address, local phone number \- No 'login' link on the home page that would indicate an account is set up after the first order, that would allow you to manage orders once placed. \- A blurry photo with only twitter IDs for contact \- No references or recommendations or affiliations that help me trust you. \- No conditions of use, or copyright, or privacy notice which are kind of standard on commerce sites.

I get you are probably in a YC cohort based on the orange Y background in the fuzzy photo. But unless you are only marketing to others in YC, the 800# and lack of all other ways to contact you is not at all confidence inspiring in terms of giving money to you, to the general public.

All that, combined with a business model where you bill it all up front, it could be perceived as a little suspect. So not one specific thing, for me a bundle of indicators. Hope that helps.

</comment><comment><USER4> I don't know if this helps but the UI feel of the site felt more like the products were adverts instead of browsing actual products to buy right-now.

Start collecting e-mail addresses en-masse for the purpose of birthday/anniversary reminders. Hit them with a prominent & simple signup form. Just email address, dates & names of occasions, submit. You can play on the forgetfulness, saying one signup and you'll never forget again.

Once you start getting within 15-30 days of those dates you'll start to see conversions growing. That's when a simple order process (4 clicks and you're done!) will boost conversion.

The fact that you are getting sales shows your idea is of interest, that percentage can only grow as you expand your gift selection and gather customer information & feedback.

</comment><comment><USER5> Where are you losing people? If no one is clicking get started, address the homepage first. If people look at products but still don't buy, start with your products page.

1\. Are you performing split testing on major components of your landing page?

"Increase your brownie points!" strikes me as awkward and mathematical (makes me think $browniePoints++). Ask a few friends in your target market to help you brainstorm.

2\. I almost missed the arrows to see more products per category. Make them more prominent and switch the circles in the top right for page numbers.

<comment><AUTHOR> Ah, forgot to say where the drop-off is. We lose most people on the gift selection page.

\- 60% make it from the homepage to the gift selection page (not bad).

\- 3% make it to from the gift selection page to the billing page (eeeeh).

It's a huge drop-off and we are trying to pin-point why. It may be a product issue, but most people have given us good feedback on our selection of products. We are going to mix in some other brands to see if it helps at all.

We have split tested the landing page and were able to increase the click- through rate by 20%. No other split tests are running at the moment.

</comment></comment><comment><USER6> Nice idea, I hope you're going to start sending anniversary reminders for those who do use your site.

I like the shopping cart items appearing in a bar, but honestly, I had no idea it was there... it was below the fold, and it was only because I started fiddling when the "add to cart" button appeared not to work, that I found it lurking. Try putting it somewhere up higher at least people can see the new items dropping in.

</comment><comment><USER7> I think the most important question is: Do people want it enough to pay for it? You can always get great feedback, but if people do NOT want to pay for it, then it doesn't really matter. Find out if the value proposition is good enough. Maybe you need more to sweeten the deal. I would recommend pushing the product to targeted users for about 1 month and see if the conversions increase.

</comment><comment><USER8> So I'm not quite sure who it's for from the homepage, and further - I am confused as to how brownies equate to buying expensive things at first glance. When I opened the homepage my first instinct was to get home delivered brownies on a regular basis.

<comment><AUTHOR> You've never heard of the term "brownie points"? Are you from outside of the US?

<comment><USER8> I'm from the US and know the term. I was merely giving a first glance impression. This is all very relevant to conversion... Even on the homepage.

Perhaps the wording on the submit button is what's throwing me off. Something more explanatory like "View our gifts", etc. that would help drive the point home to the visitor about what clicking that button will actually do.

<comment><USER2> I agree with changing text on the button, "View gift selection" makes a lot of sense.

</comment></comment></comment></comment><comment><USER9> Is there a plan to make the service appealing to women as well? It seems like you could double your potential market size pretty quickly.

</comment><comment><USER10> I operate a number of ecommerce sites, so I'll give my perspective. I will preface this by saying I like the concept, and the implementation is clean. Congratulations on your launch - it's nice to see new ideas entering the industry.

First, you should be aware that launch traffic is demographically _nothing_ like customer traffic. If your site has been posted to tech blogs, startup blogs, tweeted amongst your tech friends, etc, then most of that launch traffic is of the "I'm just checking out this cool new site" variety. This does not convert nearly as well as the "I really need to schedule a gift for my wife" variety. Expect your blog links to pay off over time in SEO linkjuice value, not in the one-week short run.

Second, you picked a bad time to launch a gift _scheduling_ service. Well over half of your potential customers have _already purchased_ the items in their gift list. And for those that haven't, they will most assuredly be going to companies with longer-running reputations that they can trust to fulfill delivery timeframes. Expect October of next year to be significantly better.

Third, the UI is probably not intuitive to people accustomed to traditional ecommerce sites. Aunt Millie is probably not going to realize that clicking on the barely-visible arrow icon on the left/right margins will display another product. One unfortunate fact about ecommerce, and one that is likely the driving force behind stagnation in design evolution, is that catering to _expectations_ is usually more valuable to conversions than catering to coolness. I say usually because there are a few exceptions to this rule( think Apple ), with heavy emphasis on _a few_.

Fourth, impatience. Seriously, it's been a week. It takes time to get to know your customers. As you learn more about them, you'll be able to craft an experience more conducive to giving them what they want, and as a by-product, increase the conversion rate.</comment>