Top all-time · #5970
David Haney
Personal blog · davidhaney.ioprogrammingcareer
David Haney's personal blog at davidhaney.io covers programming and career. Since 2019, 13 different Hacker News readers have linked it 15 times, most often “NPM and Left-Pad: Have We Forgotten How to Program? (2016)”. It is still writing: the last post was on 2025-05-29, and you can follow it by feed.
Too few sampled comments (11) to say how often HN recommends it.?
Why HN links it
HN readers link David Haney's post on the npm left-pad incident, citing it in discussions of npm's dependency culture and the risks of relying on many small packages.
Summarised by Claude from a sample of 11 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- NPM and Left-Pad: Have We Forgotten How to Program? (2016)11 people · 12 mentions · first linked 2019-06-19
What Hacker News says?
Random link: https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how... > it's supposed to be the libraries you're relying on When an ecosystem has poor engineering practices and encourages small libraries with many dependencies you get a quadratic explosion of indirect dependencies. You might not care about having 100 transitive dependencies until a poor soul has to maintain your code in 4 or 10 years from now.
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “Reasons to prefer Linux over Windows (2014)”Submitted The Tech Interview AI Cheating Epidemic as a story · 4 points
HN discussionWe've been down this road before, and learned...nothing. https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how... Stupid debates over a formatting tool - or in this case, a simple conditional - should tell you that something is seriously FUBAR in Javascriptland.
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “NPM – "is-even", 160k weekly downloads”Submitted LLMs Will Not Replace You as a story · 3 points
HN discussionCool seems like unix `cat` command with addition of storing the filepath (so maybe like `find`?) While this of course sound like a cool project and my comment might be the most Hacker News-y thing [1] I think it's aimed at developers and so it fits. I don't agree with the zip downsides listed in the repo since firstly `unzip -l` exists to see what's in a zip and secondly the argument with reuploading the zip doesn't…
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “Show HN: Stamp turns a folder into a plain text file and a file into a folder”Submitted Developers Shouldn't Measure Twice, Cut Once (2015) as a story · 2 points
HN discussionBecause we are told to move fast and import things https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how...
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “Ignore 98% of dependency alerts: introducing Semgrep Supply Chain”Submitted NPM and Left-Pad: Have We Forgotten How to Program? (2016) as a story · 1 points
HN discussionWith every dependency, you are allowing a 3rd party to inject code into your project. This can end badly e.g. #leftpad - https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how...
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “Rewriting Sysctl(8) in Rust: Systeroid”Mechanically, I believe the main difference is that NPM corresponds to PyPi + pip; it's both registry and repository. PyPi is Python's official package repository and pip's default source, but it's not pip's only possible source. If someone pulls code off PyPi, pip can still link to it elsewhere. When the left-pad debacle [1] broke major packages, the triggering event was that NPM-the-registry took a module name awa…
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “NPM CEO Bryan Bogensberger Resigned”That's exactly why it's insane. People remember the pad-left fiasco. Previously discussed here: https://news.ycombinator.com/item?id=11348798 Article now resides here: https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how...
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “An overengineered solution to `sort | uniq -c` with 25x throughput (hist)”Not true at all, at least for Ruby. Most larger React projects have _far more_ dependencies_ than an equivalent Ruby project. You could chalk it up to a few things I think: * the JS ecosystem is just much larger - more devs (especially inexperienced ones) means more code and more copy/pasting solutions that rely on `npm install` from the web. * JS has just not been as stable and mature as Ruby or Python until the pa…
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “Finding relationships between Ruby’s top packages and their dependencies”Humans are stupid and cannot learn anything https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how...
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “One liner NPM package “is-windows” has 2.5M dependants, why on earth?”updated URL: https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how...
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “NPM and Left-Pad: Have We Forgotten How to Program? (2016)”Now, we have definitely had such things happen with package managers, as people pull repos: https://www.bleepingcomputer.com/news/security/dev-corrupts-... And it's human nature to be lazy: https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how... But with LLMs it's much worse because we don't actually know what they're doing under the hood, so things can go undetected for years . What this article is essentia…
Comment linking /npm-left-pad-have-we-forgotten-how-to-program/
on “PoisonGPT: We hid a lobotomized LLM on Hugging Face to spread fake news”
