The internet broke this week because of eleven lines of code. A developer, after a naming dispute, unpublished all his npm modules, including “left-pad,” eleven lines that pad a string. Thousands of builds worldwide instantly failed: Babel, React tooling, half the JavaScript ecosystem, all transitively depending on a function a first-year student could write, all discovering it simultaneously at build time. npm un-unpublished it (raising its own governance questions), and the postmortem discourse has been glorious: dependency trees nobody audits, the left-pad-as-a-service economy, “have we forgotten how to program?”
My senior-engineer take: the eleven lines aren’t the embarrassment. The single point of failure with no pinning, no mirror, and no vendoring is. We audited our own lockfiles this week; our tiny app depends on 1,400 packages. I can name forty.
Also this same week, because 2016 has range: Microsoft launched Tay, a Twitter chatbot that learns from conversation, and the internet taught it to be a Nazi in sixteen hours. Deleted. If your system learns from user input, your users are now your training team, including the worst ones. Input validation for models is going to be a whole career for somebody.
TIL: npm shrinkwrap, vendoring trade-offs, and that our build now survives npm being down. Resilience homework, courtesy of eleven lines.