←back to thread

2525 points hownottowrite | 1 comments | | HN request time: 0.226s | source
Show context
Aozi ◴[] No.21190660[source]
What we need is a JS developer to take down an important package from NPM in protest, thus breaking the Internet again.
replies(2): >>21190743 #>>21194973 #
byte1918 ◴[] No.21190743[source]
The NPM fiasco should no longer be possible

If you want to unpublish a package after 72 hours have passed, contact npm Support. For more information about why we don’t allow users to unpublish packages after 72 hours, see our unpublish policy.

https://docs.npmjs.com/unpublishing-packages-from-the-regist...

replies(4): >>21190798 #>>21190801 #>>21190806 #>>21191523 #
Crinus ◴[] No.21190806[source]
Not sure how npm works in detail, doesn't it pull directly from devs' repositories? In that case can't the devs just publish an update that breaks everything?
replies(2): >>21190848 #>>21190870 #
1. julianwachholz ◴[] No.21190848[source]
This wouldn't be as big of a problem with version pinning.